Executive brief
Robots::Validate is a Perl module that validates client User-Agent headers against robot policies defined in a robots.txt file. A vulnerability in DNS validation allows attackers to generate unbounded outbound DNS queries by controlling the reverse DNS zone for their own IP address. An attacker can cause the server to perform dozens or hundreds of DNS lookups per validation, leading to denial-of-service conditions and resource exhaustion on the validating server.
Technical details
The vulnerability exists in the _check_dns function, which performs forward-confirmation of reverse DNS lookups. When validating a client, the module issues a PTR query for the client's IP address, filters the returned names by domain, and then performs an A/AAAA forward lookup for each name to verify reverse-DNS consistency. An attacker controlling the reverse zone for their own IP address can return an arbitrary number of PTR records matching the rule's domain, forcing the server to perform one forward DNS lookup per record. Because each forward lookup uses a distinct, client-controlled name, all queries miss the local cache and must be resolved against authoritative servers. The queries are synchronous, blocking the caller until all DNS timeouts or responses complete. The fix, released in version 0.3.11, introduces a max_forward_lookups attribute (default: 4) that limits the number of forward confirmations performed per validation.
Affected products
- CPAN Robots::Validate 0.3.2 to 0.3.10
Timeline
- 2026-09-04: disclosed: CVE-2026-82309 published
- 2026-08-28: patched: Fix released in version 0.3.11 with max_forward_lookups limit