Executive brief
Net::DNS is a popular Perl library used by applications to perform DNS lookups and process network traffic. A vulnerability in how the library handles specific DNS data formats could allow a remote attacker to crash applications using this library by sending a specially crafted network packet. This results in a denial-of-service, potentially disrupting internet-facing services or internal tools that process untrusted DNS data.
Technical details
An uncontrolled recursion vulnerability exists in Net::DNS::DomainName::decode due to the lack of a depth limit when following RFC 1035 compression pointers. While the library prevents forward and circular chains, it allows arbitrarily long backward chains. An attacker can craft a DNS packet with a chain of two-byte compression pointers that saturates the Perl C stack, leading to a SIGSEGV and process crash. The issue is triggered during the decoding of wire-format DNS messages, such as when calling Net::DNS::Packet->new(). This vulnerability was addressed in version 1.56.
Affected products
- NLnet Labs Net::DNS through 1.55
Timeline
- 2026-07-10: patched: Fix committed in version 1.55_01 development release.
- 2026-07-18: advisory: Official release of version 1.56 containing the fix.
- 2026-07-20: disclosed: CVE published to NVD.