Executive brief
Net::DNS is a Perl library for DNS operations used by DNS clients, forwarders, and proxies. A vulnerability in message re-encoding allows attackers to trigger unbounded recursion that exhausts server memory and crashes the service. The issue occurs only when processing specially crafted DNS messages with malformed TSIG records, affecting systems that re-encode decoded DNS messages such as DNS forwarders and proxies.
Technical details
The vulnerability is a denial-of-service via unbounded recursion in the sig_data function, which is responsible for signing DNS messages. When a TSIG record with an empty MAC is placed in the answer or authority section (instead of the additional section as required by RFC 8945), the decoding step leaves it in place with only a warning rather than rejecting the message. Upon re-encoding, sig_data is called recursively with no termination condition, as each cycle re-encodes the entire message. The attack is network-reachable and requires no authentication. Vulnerable versions are Net::DNS before 1.57; the recursion is reached only from code that re-encodes a message (such as forwarders and proxies), and only if the TSIG carries an empty MAC. Fewer than 100 bytes on the wire can exhaust available memory and terminate the process.
Affected products
- Perl Net::DNS before 1.57
Timeline
- 2026-09-02: disclosed