CVE-2026-64194

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

CVSS

No CVSS.

References

Link	Resource
https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
https://rt.cpan.org/Ticket/Display.html?id=179946
https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
http://www.openwall.com/lists/oss-security/2026/07/20/13

Configurations

No configuration.

History

20 Jul 2026, 21:16

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/07/20/13 -

20 Jul 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-20 19:17

Updated : 2026-07-20 21:16

NVD link : CVE-2026-64194

Mitre link : CVE-2026-64194

CVE.ORG link : CVE-2026-64194

JSON object : View

Products Affected

No product.

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-64194", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://www.net-dns.org/svn/net-dns/", "vendor": "NLNETLABS", "product": "Net::DNS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.55"}], "packageName": "Net-DNS", "programFiles": ["lib/Net/DNS/DomainName.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::DNS::DomainName::decode"}]}]}], "published": "2026-07-20T19:17:30.157", "references": [{"url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://rt.cpan.org/Ticket/Display.html?id=179946", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/20/13", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network."}], "lastModified": "2026-07-20T21:16:50.320", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}