Unbounded Outbound DNS Query Vulnerability in Perl Robots::Validate
CVE-2026-82309
Currently unrated
What is CVE-2026-82309?
A vulnerability exists in versions 0.3.2 through 0.3.10 of Perl's Robots::Validate, where the validation process allows for unbounded outbound DNS queries. This occurs through a forward-confirmation loop that permits clients to generate an arbitrary number of DNS queries influenced by client-chosen PTR records. The querying mechanism does not impose any limitation on the number of requests sent, potentially leading to resource exhaustion. Each DNS query bypasses local caches, as they are determined by client-specified rules, which may cause delays or timeouts due to synchronous querying. The issue highlights a critical need for proper bounding of outbound requests to prevent abuse and service disruption.