CVE-2026-64194
Received Received - Intake

Denial of Service in Net::DNS Perl Library

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: CPANSec

Description
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64194
EUVD
EUVD-2026-46052

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
net_dns net_dns 1.55
net_dns net_dns 1.56

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Net::DNS Perl library versions through 1.55. It allows a Denial of Service attack via deep DNS compression pointer chains. The issue occurs because the library's domain name decoding function follows RFC 1035 compression pointers without a depth limit, enabling crafted packets to create long chains that exhaust the call stack, leading to process crashes.

Detection Guidance

This vulnerability is triggered by parsing crafted DNS packets using Net::DNS versions through 1.55. To detect it, monitor for excessive recursion or crashes in applications using this library when processing DNS responses. Check Perl applications that handle untrusted DNS data for stack overflow errors or segmentation faults.

Impact Analysis

If you use the affected Net::DNS library to parse untrusted DNS data, an attacker could send a maliciously crafted DNS response that triggers excessive recursion. This would crash your application or service, causing a Denial of Service. The impact is limited to systems parsing DNS packets from untrusted sources.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by crashing applications parsing untrusted DNS data due to stack overflow from deep compression pointer chains. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR or HIPAA compliance. However, a DoS condition could disrupt services handling sensitive data, potentially leading to compliance violations if critical systems become unavailable.

Mitigation Strategies

Upgrade Net::DNS to a version that includes a depth limit for DNS compression pointer chains. If upgrading is not immediately possible, restrict parsing of untrusted DNS data or implement application-level safeguards to limit recursion depth.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart