{"id":"CVE-2026-64194","aliases":["DEBIAN-CVE-2026-64194","EUVD-2026-46052","GHSA-m3gj-74x3-vc94","MGASA-2026-0448","SUSE-SU-2026:3431-1","SUSE-SU-2026:3456-1","UBUNTU-CVE-2026-64194","openSUSE-SU-2026:11396-1","openSUSE-SU-2026:21437-1","openSUSE-SU-2026:21859-1"],"status":"published","title":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0068,"percentile":0.52704,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-07-20T17:55:05Z","modified":"2026-10-25T09:47:41Z","fixes":[{"ecosystem":"Debian:12","package":"libnet-dns-perl","fixed_in":["1.36-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnet-dns-perl","fixed_in":["1.56-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-dns-perl","fixed_in":["1.56-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-Net-DNS","fixed_in":["0.73-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-Net-DNS","fixed_in":["0.73-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-1+deb12u1"}]}],"versions":["1.36-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-0+deb13u1"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.360.0-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.68-1.2","0.68-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.81-2","0.81-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20-1","1.21-1","1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29-1","1.32-1","1.33-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-2ubuntu1","1.40-1ubuntu1","1.44-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.54-1ubuntu1","1.55-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.50-1ubuntu1","1.53-1ubuntu1","1.54-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.560.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.460.0-bp160.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"nlnetlabs","product":"net::dns"}],"references":[{"url":"https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179946","tags":["issue-tracking","web","report"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes","tags":["release-notes","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/20/13"},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64194"},{"url":"https://github.com/advisories/GHSA-m3gj-74x3-vc94"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64194","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0448.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35968","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/13","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179945","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00370.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/02/1","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L245-262","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L62-73","tags":["web"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8945#section-5.2","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=181125","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.57/changes","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TS4YPB3LGX5Q5VWSYLSIQZWXJU4UMZN/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GGGP7EQRAUOGLVT6K5VJ7U3KCA7YMNZZ/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263431-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272214","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64194","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263456-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-64194","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64194","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41989541/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64193","tags":["web"]},{"url":"https://bugzilla.suse.com/1272212","tags":["report"]},{"url":"https://bugzilla.suse.com/1278084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81928","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64194","title":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T17:55:05.169Z","modified":"2026-08-30T20:06:49.756Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-46052","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T17:55:05Z","modified":"2026-08-30T20:06:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:21.466916Z"}],"ghsa":[{"id":"GHSA-m3gj-74x3-vc94","title":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer...","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T21:31:50Z","modified":"2026-08-30T21:30:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:11:10.168906Z"}],"nvd":[{"id":"CVE-2026-64194","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T19:17:30.157Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-64194","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.  Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.  The guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.  A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.  The vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T19:17:30.157Z","modified":"2026-10-25T09:47:41.070329818Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:58.307012Z"},{"id":"UBUNTU-CVE-2026-64194","description":"Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.","status":"published","published":"2026-07-20T19:17:00Z","modified":"2026-10-17T12:59:16.136263036Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:48.57134Z"},{"id":"MGASA-2026-0448","title":"Updated perl-Net-DNS packages fix security vulnerabilities","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection\nvia EDNS EXTENDED ERROR. (CVE-2026-64193)\nNet::DNS versions through 1.55 for Perl allow Denial of Service via deep\nDNS compression pointer chains. (CVE-2026-64194)\nNet::DNS versions before 1.57 for Perl allow memory exhaustion via\nunbounded recursion in sig_data when re-encoding a message with a\nmisplaced TSIG record. (CVE-2026-81928)\n","status":"published","published":"2026-09-24T16:06:15Z","modified":"2026-09-24T16:15:03.338436977Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11396-1","title":"perl-Net-DNS-1.560.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Net-DNS-1.560.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:27.222151577Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21437-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issues:\n\nChanges in perl-Net-DNS:\n\n- CVE-2026-64194: Fixed a Denial of Service via deep DNS compression pointer chains [bsc#1272214]\n- CVE-2026-64193: Fixed a remote execution injection [bsc#1272212]\n","status":"published","published":"2026-07-22T20:52:16Z","modified":"2026-07-24T17:16:08.604357306Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21859-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issues:\n\nChanges in perl-Net-DNS:\n\nUpdated to 1.570.0 (1.57):\n\nSee /usr/share/doc/packages/perl-Net-DNS/Changes .\n\n  -     Resync with IANA DNS parameters registry.\n  -     EDNS: Add support for MQTYPE-QUERY option.\n  -     Unbounded recursion when re-encoding message with misplaced TSIG CVE-2026-81928 bsc#1278084\n  -     UNIX resolver can fail in taint mode\n\n  -     Documentation issue for Net::DNS::RR::RRSIG::verify()\n  -     Denial of Service via long DNS compression chains CVE-2026-64194 bsc#1272214\n  -     Remote code injection via EDNS EXTENDED ERROR CVE-2026-64193 bsc#1272212\n  -     UNIX.pm: Unreachable code warning using Apache/mod_perl\n","status":"published","published":"2026-09-15T13:20:42Z","modified":"2026-09-17T18:23:16.206853539Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:3431-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issue\n\n- CVE-2026-64194: RFC 1035 compression pointers are followed via recursion with no depth limit established, which\n  can lead to DoS when specially crafted DNS packets are parsed (bsc#1272214).\n","status":"published","published":"2026-07-30T18:50:12Z","modified":"2026-07-31T17:15:06.910926392Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3456-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issue\n\n- CVE-2026-64194: RFC 1035 compression pointers are followed via recursion with no depth limit established, which\n  can lead to DoS when specially crafted DNS packets are parsed (bsc#1272214).\n","status":"published","published":"2026-08-03T11:50:38Z","modified":"2026-08-04T11:45:08.557031974Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}