CVE-2026-64194 in Net::DNS
Summary
by MITRE • 07/20/2026
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.
Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.
The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.
A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.
The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in Net::DNS versions through 1.55 represents a critical denial of service weakness that exploits recursive DNS compression pointer handling without proper depth limitations. This flaw exists within the Net::DNS::DomainName::decode function which implements RFC 1035 compliant DNS compression pointer resolution but fails to enforce adequate recursion depth constraints. The implementation follows compression pointers recursively through self-calls without imposing boundaries on the traversal depth, creating a potential stack exhaustion scenario when processing maliciously crafted DNS responses.
The technical implementation of this vulnerability stems from the insufficient guard mechanism that only prevents forward and circular pointer chains but permits arbitrarily long backward pointer chains. While the code includes a protection check using `$link < $offset` to avoid certain types of pointer loops, it does not address the fundamental issue of unlimited backward recursion through compression pointers. The per-offset cache `$cache` variable is populated at each function call start and only prevents re-traversal of the same offset, meaning that fresh chains still execute full recursive depth without limitation. This design flaw allows attackers to construct DNS packets containing specially crafted two-byte compression pointers where each pointer references a location two bytes earlier than the previous one.
The attack vector specifically targets the Net::DNS::Packet->new(\$wire) method execution path which occurs whenever the library processes DNS messages from network sources. When processing TCP DNS messages, the vulnerability can potentially generate recursive call frames up to 32767 times due to the 16-bit length field limitation, while UDP responses are constrained by the 14-bit pointer field maximum of 16383 bytes, creating chains of approximately 8191 recursive frames. This recursive descent consumes system stack resources rapidly, with Perl's default C stack implementation typically handling only a few thousand frames before encountering SIGSEGV signals or similar termination conditions that result in denial of service.
This vulnerability maps directly to CWE-674 - Uncontrolled Recursion and aligns with ATT&CK technique T1499.004 - Endpoint Denial of Service, representing an indirect method of service disruption through resource exhaustion. The impact extends beyond simple application crashes to potentially affect any system or service that relies on Net::DNS for DNS message parsing, including web servers, DNS resolvers, and network monitoring tools. Given that DNS processing is fundamental to internet infrastructure, this vulnerability could be exploited in various attack scenarios where an attacker controls or can influence DNS responses, making it particularly dangerous in environments where untrusted DNS data is processed without additional validation layers.
Effective mitigations include implementing explicit recursion depth limits within the Net::DNS::DomainName::decode function, adding comprehensive input validation for compression pointer chains, and establishing maximum stack traversal thresholds that prevent excessive recursive calls. Additionally, applications should implement proper error handling for stack overflow conditions and consider deploying network-level protections such as DNS response filtering and rate limiting mechanisms to detect and block suspicious DNS traffic patterns. The vulnerability highlights the importance of implementing robust bounds checking in protocol parsing libraries and demonstrates how seemingly innocuous RFC compliance can introduce security weaknesses when recursion is not properly constrained.