{"id":"CVE-2026-81928","aliases":["ALSA-2026:68786","ALSA-2026:68787","DEBIAN-CVE-2026-81928","EUVD-2026-69727","GHSA-x88w-xx7m-3m5f","MGASA-2026-0448","RHSA-2026:68786","RHSA-2026:68787","RLSA-2026:68786","RLSA-2026:68787","SUSE-SU-2026:4065-1","SUSE-SU-2026:4086-1","UBUNTU-CVE-2026-81928","openSUSE-SU-2026:11708-1","openSUSE-SU-2026:21859-1"],"status":"published","title":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.\n\nsig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.\n\nThe recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.\n\nEach cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00684,"percentile":0.53007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-09-01T23:14:52Z","modified":"2026-10-29T11:32:32Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"perl-Net-DNS","fixed_in":["1.29-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"perl-Net-DNS-Nameserver","fixed_in":["1.29-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-Net-DNS","fixed_in":["1.15-2.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-dns-perl","fixed_in":["1.57-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Net-DNS","fixed_in":["0:1.29-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-Net-DNS-Nameserver","fixed_in":["0:1.29-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-Net-DNS","fixed_in":["0:1.15-2.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"perl-Net-DNS","fixed_in":["0:1.29-6.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-Net-DNS","fixed_in":["0:1.15-2.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-Net-DNS","fixed_in":["0.73-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-Net-DNS","fixed_in":["1.14-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-DNS","fixed_in":["1.570.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-Net-DNS-Nameserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-2.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-1","1.36-1+deb12u1","1.39-1","1.39-2","1.40-1","1.41-1","1.42-1","1.43-1","1.44-1","1.45-1","1.46-1","1.47-1","1.48-1","1.49-1","1.50-1","1.53-1","1.54-1","1.55-1","1.56-1","1.57-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1","1.56-0+deb13u1","1.56-1","1.57-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.57-1"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1","1.56-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.360.0-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"perl-Net-DNS-Nameserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-2.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.29-6.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-2.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.73-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.68-1.2","0.68-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.81-2","0.81-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20-1","1.21-1","1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29-1","1.32-1","1.33-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-2ubuntu1","1.40-1ubuntu1","1.44-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.54-1ubuntu1","1.55-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.50-1ubuntu1","1.53-1ubuntu1","1.54-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-bp160.1.1"}]}],"bundled":3}],"references":[{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L245-262","tags":["web","article"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L62-73","tags":["web","article"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8945#section-5.2","tags":["web","article"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=181125","tags":["issue-tracking","web","article","report"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.57/changes","tags":["release-notes","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/02/1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81928","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x88w-xx7m-3m5f"},{"url":"https://access.redhat.com/errata/RHSA-2026:68786","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81928","tags":["report"]},{"url":"https://bugzilla.redhat.com/2527155","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-68786.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68787","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-68787.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-81928","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0448.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35968","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/13","tags":["web"]},{"url":"https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179945","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179946","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00370.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/02/1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TS4YPB3LGX5Q5VWSYLSIQZWXJU4UMZN/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GGGP7EQRAUOGLVT6K5VJ7U3KCA7YMNZZ/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527155","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68786.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81928","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68787.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68786","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68787","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264065-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81928","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264086-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-81928","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/43194862/","tags":["report"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.57/diff/NLNETLABS/Net-DNS-1.56","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272212","tags":["report"]},{"url":"https://bugzilla.suse.com/1272214","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64194","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-81928","title":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.\n\nsig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.\n\nThe recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.\n\nEach cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-01T23:14:52.133Z","modified":"2026-09-02T19:24:12.656Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:36:18.075535Z"}],"euvd":[{"id":"EUVD-2026-69727","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.\n\nsig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.\n\nThe recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.\n\nEach cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-01T23:14:52Z","modified":"2026-09-02T19:24:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-x88w-xx7m-3m5f","title":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in...","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.\n\nsig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.\n\nThe recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.\n\nEach cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-02T00:31:31Z","modified":"2026-09-02T21:33:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:11:18.49317Z"}],"nvd":[{"id":"CVE-2026-81928","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.\n\nsig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.\n\nThe recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.\n\nEach cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-02T00:18:26.147Z","modified":"2026-09-03T16:41:09.297Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"DEBIAN-CVE-2026-81928","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.  sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.  The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.  Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-02T00:18:26.147Z","modified":"2026-10-01T03:03:44.308362736Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"RHSA-2026:68786","title":"Red Hat Security Advisory: perl-Net-DNS security update","status":"published","published":"2026-09-18T10:15:36Z","modified":"2026-09-18T10:32:25.925815774Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68787","title":"Red Hat Security Advisory: perl-Net-DNS security update","status":"published","published":"2026-09-18T10:15:37Z","modified":"2026-09-18T10:32:25.876158951Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:68786","title":"Important: perl-Net-DNS security update","description":"The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines.\n\nSecurity Fix(es):\n\n* perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:04:58.550496Z","modified":"2026-09-19T12:30:02.607035298Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:68787","title":"Important: perl-Net-DNS security update","description":"The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines.\n\nSecurity Fix(es):\n\n* perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T06:01:33.521772Z","modified":"2026-09-19T06:30:02.600321236Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-81928","description":"Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises \"misplaced or corrupt TSIG\", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.","status":"published","published":"2026-09-02T00:18:00Z","modified":"2026-10-17T13:01:11.571298204Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"ALSA-2026:68786","title":"Important: perl-Net-DNS security update","description":"The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines.  \n\nSecurity Fix(es):  \n\n  * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:32:32.043105378Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:68787","title":"Important: perl-Net-DNS security update","description":"The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines.  \n\nSecurity Fix(es):  \n\n  * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:02:29.421295147Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"MGASA-2026-0448","title":"Updated perl-Net-DNS packages fix security vulnerabilities","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection\nvia EDNS EXTENDED ERROR. (CVE-2026-64193)\nNet::DNS versions through 1.55 for Perl allow Denial of Service via deep\nDNS compression pointer chains. (CVE-2026-64194)\nNet::DNS versions before 1.57 for Perl allow memory exhaustion via\nunbounded recursion in sig_data when re-encoding a message with a\nmisplaced TSIG record. (CVE-2026-81928)\n","status":"published","published":"2026-09-24T16:06:15Z","modified":"2026-09-24T16:15:03.338436977Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11708-1","title":"perl-Net-DNS-1.570.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Net-DNS-1.570.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.30140592Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21859-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issues:\n\nChanges in perl-Net-DNS:\n\nUpdated to 1.570.0 (1.57):\n\nSee /usr/share/doc/packages/perl-Net-DNS/Changes .\n\n  -     Resync with IANA DNS parameters registry.\n  -     EDNS: Add support for MQTYPE-QUERY option.\n  -     Unbounded recursion when re-encoding message with misplaced TSIG CVE-2026-81928 bsc#1278084\n  -     UNIX resolver can fail in taint mode\n\n  -     Documentation issue for Net::DNS::RR::RRSIG::verify()\n  -     Denial of Service via long DNS compression chains CVE-2026-64194 bsc#1272214\n  -     Remote code injection via EDNS EXTENDED ERROR CVE-2026-64193 bsc#1272212\n  -     UNIX.pm: Unreachable code warning using Apache/mod_perl\n","status":"published","published":"2026-09-15T13:20:42Z","modified":"2026-09-17T18:23:16.206853539Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4065-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issue:\n\n- CVE-2026-81928: memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG\n  record (bsc#1278084).\n","status":"published","published":"2026-09-08T07:03:05Z","modified":"2026-09-13T18:23:19.666334965Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4086-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issue:\n\n- CVE-2026-81928: memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG\n  record (bsc#1278084).\n","status":"published","published":"2026-09-08T10:22:58Z","modified":"2026-09-13T18:23:20.462644876Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}