Net::DNS CVE-2026-64194

|

EUVD

EUVD-2026-46052 HIGH

Uncontrolled Recursion (CWE-674)

2026-07-20 CPANSec

GHSA-m3gj-74x3-vc94

Denial Of Service Net Nlnetlabs

7.5

CVSS 3.1 · Vendor: CPANSec

Share

Severity by source

Vendor (CPANSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

A single crafted DNS response parsed by default code paths gives remote unauthenticated no-interaction exploitation (AV:N/AC:L/PR:N/UI:N); impact is a crash only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

4

Analysis Generated

Jul 21, 2026 - 21:43 vuln.today

CVSS changed

Jul 21, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jul 20, 2026 - 17:55 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 17:55 cve.org

HIGH 7.5

DescriptionCVE.org

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.

The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.

A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.

The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.

AnalysisAI

Denial of service in the Net::DNS Perl library (versions through 1.55) lets a remote attacker crash any application that parses untrusted DNS messages by sending a crafted response with a deeply nested chain of compression pointers. Net::DNS::DomainName::decode recurses once per pointer with no depth cap, so a chain of ~8191 (UDP/14-bit) to ~32767 (TCP/16-bit) two-byte pointers exhausts Perl's C stack and triggers SIGSEGV. EPSS is low (0.20%, 10th percentile) and there is no public exploit identified at time of analysis, though CPANSec/oss-security disclosure provides enough detail to reconstruct a trigger.

Technical ContextAI

Net::DNS is a pure-Perl DNS resolver/packet library. The flaw is a CWE-674 uncontrolled recursion in the RFC 1035 message-compression decoder: DomainName::decode follows each compression pointer by recursing into itself. The $link < $offset guard blocks forward and circular references, and a per-offset $cache short-circuits re-traversal of an already-seen offset, but neither bounds the initial descent through a fresh chain. An attacker builds pointers where each points exactly two bytes earlier than the last, yielding a chain of length offset/2 and forcing that many stack frames on first traversal. Because Perl's default interpreter stack tolerates only a few thousand nested C frames, the descent overflows the stack before any cache benefit applies.

RemediationAI

Vendor-released patch: Net::DNS 1.55_01 (developer release feeding the 1.56 release candidate) - upgrade to the fixed release once 1.56 is generally available, or to 1.55_01 in the interim, per https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56 and https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes. Until upgraded, reduce exposure by preferring UDP over TCP for DNS where feasible (the UDP 14-bit offset caps the chain at ~8191 frames versus ~32767 over TCP, though even the UDP depth can crash some builds, so this only lowers not removes risk), and by validating or size-limiting untrusted DNS payloads before handing them to Net::DNS::Packet->new. Running the parsing component as an isolated, auto-restarting worker process limits a crash to that worker rather than the whole service; the trade-off is added operational complexity and continued availability blips under repeated attack. Track the oss-security advisory at https://seclists.org/oss-sec/2026/q3/185 and CPAN ticket https://rt.cpan.org/Ticket/Display.html?id=179946 for the final release version.

More in Net

View all

CVE-2023-44487 HIGH Act Now POC

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2023-38180 HIGH Act Now

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e

CVE-2026-71328 HIGH This Week POC

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when

CVE-2026-62886 HIGH This Week POC

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f

CVE-2026-62871 HIGH This Week POC

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r

CVE-2026-70354 HIGH This Week POC

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH This Week POC

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH This Week POC

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH This Week POC

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com

CVE-2026-62898 HIGH This Week POC

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u

CVE-2026-26127 HIGH This Week POC

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]

CVE-2026-33811 HIGH This Week POC

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali

Same weakness CWE-674 – Uncontrolled Recursion

View all

CVE-2019-9545 HIGH POC

CVE-2019-9543 HIGH POC

CVE-2019-9144 HIGH POC

CVE-2019-9143 HIGH POC

CVE-2026-9769 HIGH POC

CVE-2026-40345 HIGH POC

CVE-2025-9624 HIGH POC

CVE-2019-9192 HIGH POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Leap 16.0	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Affected

Share

CVE-2026-64194 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy