Memory Exhaustion Vulnerability in Net::DNS for Perl

CVE-2026-81928

What is CVE-2026-81928?

A vulnerability exists in Net::DNS for Perl that allows for memory exhaustion due to unbounded recursion in the sig_data function when handling improperly encoded messages containing misplaced TSIG records. When a TSIG record appears in the answer or authority sections instead of the additional section, and if it carries an empty MAC, the re-encoding process enters a recursive loop that consumes available memory. This situation typically arises in scenarios involving message proxies or forwarders, making it crucial for users relying on Net::DNS to be aware of this flaw and upgrade to version 1.57 or later to mitigate the risk.

References