Junglewise Threat Intelligence

CVE-2026-64194: Net::DNS uncontrolled recursion in DomainName decode

CVE-2026-64194 · Severity: info · CVSS 5.3 · Published 2026-07-20

Vendors: NLnet Labs.

Executive brief

Net::DNS is a popular Perl library used by applications to perform DNS lookups and process network traffic. A vulnerability in how the library handles specific DNS data formats could allow a remote attacker to crash applications using this library by sending a specially crafted network packet. This results in a denial-of-service, potentially disrupting internet-facing services or internal tools that process untrusted DNS data.

Technical details

An uncontrolled recursion vulnerability exists in Net::DNS::DomainName::decode due to the lack of a depth limit when following RFC 1035 compression pointers. While the library prevents forward and circular chains, it allows arbitrarily long backward chains. An attacker can craft a DNS packet with a chain of two-byte compression pointers that saturates the Perl C stack, leading to a SIGSEGV and process crash. The issue is triggered during the decoding of wire-format DNS messages, such as when calling Net::DNS::Packet->new(). This vulnerability was addressed in version 1.56.

Affected products

  • NLnet Labs Net::DNS through 1.55

Timeline

  • 2026-07-10: patched: Fix committed in version 1.55_01 development release.
  • 2026-07-18: advisory: Official release of version 1.56 containing the fix.
  • 2026-07-20: disclosed: CVE published to NVD.

References

Related threats