Uncontrolled recursion denial of service in Net::DNS for Perl (CVE-2026-64194)

Net::DNS versions through 1.55 for Perl contain an uncontrolled recursion vulnerability in `Net::DNS::DomainName::decode`, which follows RFC 1035 DNS compression pointers without enforcing a depth limit. A remote attacker can craft a DNS packet containing a deep backward compression pointer chain that exhausts the Perl process call stack, causing a SIGSEGV or similar crash and resulting in denial of service for any application that parses untrusted DNS data via this library. Affected versions: - through 1.55 We recommend updating to: 1.56. CVSS 7.5 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/185 Details: https://vuln.today/cve/CVE-2026-64194