Net::DNS CVE-2026-64194

Exploitation requires only that the target application parse an attacker-controlled DNS message with Net::DNS (any call reaching Net::DNS::Packet->new on untrusted wire data) using an affected version ≤1.55 - no authentication, no user interaction, and default configuration. The concrete prerequisite is a crafted name built from a chain of ~2-byte compression pointers each referencing two bytes earlier; the practical chain depth (and thus reliability) is limited by transport: UDP caps offsets at the 14-bit field (~8191 frames) while TCP allows the 16-bit length field (~32767 frames), so larger TCP responses are the most reliable trigger. Limiting factors: the attacker must be positioned to deliver a DNS response to the victim, and success depends on the Perl build's actual C stack size - some hardened or larger-stack builds may survive shallower chains, converting a crash into mere resource pressure.

Signals are internally consistent and point to a real but bounded issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, 7.5 HIGH) correctly reflects remote, unauthenticated, no-interaction exploitation against default parsing behavior, with impact limited to availability (C:N/I:N). SSVC agrees on scope: Exploitation=none (no observed attacks), Automatable=yes (a single crafted packet works repeatedly), Technical Impact=partial (crash, not code execution or data loss). EPSS of 0.20% and absence from CISA KEV indicate no active exploitation. The realistic risk is a process crash of whatever consumes untrusted DNS - meaningful for resolvers, mail filters (e.g. SpamAssassin) and monitoring daemons, but it does not yield RCE. Prioritize patching where Net::DNS parses attacker-influenced responses; deprioritize where it only handles trusted internal traffic.

An attacker who can return DNS responses to a target - for example an authoritative server the victim queries, an on-path spoofer, or a service that resolves attacker-supplied hostnames - returns a message whose name field is a chain of thousands of backward-pointing two-byte compression pointers. When the victim application calls Net::DNS::Packet->new(\$wire) to parse it, decode recurses to full chain depth and overflows the stack, killing the process. No public exploit is identified at time of analysis, but the oss-security writeup describes the construction precisely.