CVE-2026-81928
Received Received - Intake

Memory Exhaustion via Recursive TSIG Handling in Net::DNS

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: CPANSec

Description
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-81928
EUVD
EUVD-2026-69727

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
net-dns net_dns to 1.57 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Net::DNS versions before 1.57 for Perl causes memory exhaustion via unbounded recursion during message re-encoding when a misplaced TSIG record is present. The issue occurs because TSIG records not removed from the answer or authority sections are re-signed repeatedly without a termination condition, leading to rapid memory consumption and process termination.

Detection Guidance

Detecting this vulnerability requires monitoring for memory exhaustion or crashes in Net::DNS versions before 1.57. Check Perl applications using Net::DNS for unusual memory usage or process termination during DNS message processing. No specific commands are provided in the context.

Impact Analysis

This vulnerability can crash applications using affected Net::DNS versions by exhausting memory, potentially causing denial-of-service conditions. It affects systems acting as forwarders or proxies that re-encode decoded DNS messages with TSIG records, leading to unexpected termination of services relying on Net::DNS.

Compliance Impact

This vulnerability causes memory exhaustion via unbounded recursion in DNS message processing, which could lead to service disruption or denial of service. While not directly related to GDPR or HIPAA compliance, such disruptions may impact availability requirements under these regulations, potentially violating data access or processing obligations.

Mitigation Strategies

Upgrade Net::DNS to version 1.57 or later to address the memory exhaustion issue. Review DNS forwarders or proxies using Net::DNS to ensure they do not re-encode messages with misplaced TSIG records. Monitor for abnormal memory usage in affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81928. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart