CVE-2026-64194: Net::DNS for Perl DoS Vulnerability

CVE-2026-64194 Overview

CVE-2026-64194 is a denial-of-service vulnerability in the Net::DNS Perl module, affecting versions through 1.55. The flaw resides in Net::DNS::DomainName::decode, which recursively follows RFC 1035 DNS name compression pointers without enforcing a depth limit. An attacker who can deliver a crafted DNS message to any application using the library can exhaust the process call stack. The recursion terminates with SIGSEGV, halting DNS parsing for any consumer of untrusted DNS data. The issue is classified under [CWE-674: Uncontrolled Recursion] and impacts a widely deployed Perl DNS parsing library maintained by NLnet Labs.

Critical Impact
Any Perl application that decodes DNS messages from the network with Net::DNS ≤ 1.55 can be crashed by a single crafted packet, disrupting DNS-dependent services.

Affected Products

Net::DNS for Perl, all versions through 1.55
Perl applications invoking Net::DNS::Packet->new(\$wire) on untrusted input
DNS resolvers, mail servers, and monitoring tools built on Net::DNS

Discovery Timeline

2026-07-20 - CVE-2026-64194 published to NVD
2026-07-20 - Coordinated disclosure via OpenWall OSS-Security
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64194

Vulnerability Analysis

The vulnerability lies in how Net::DNS::DomainName::decode resolves DNS name compression. RFC 1035 permits a two-byte pointer inside a name to reference an earlier offset in the message, avoiding repeated encoding of shared suffixes. The Net::DNS implementation follows those pointers by calling itself recursively, with no bound on chain length. Each hop consumes a native C stack frame in the Perl interpreter.

The existing guard $link < $offset blocks forward jumps and immediate loops, but it permits an unlimited number of strictly decreasing backward hops. The per-offset $cache prevents re-traversal of a previously visited offset, yet the first descent through a novel chain still recurses at full depth before any cache entry is written.

A crafted message can place a two-byte pointer at every even offset, each referencing the offset two bytes earlier. This yields a chain length of offset / 2. UDP messages capped by the 14-bit pointer field allow roughly 8,191 frames, while TCP messages bounded by the 16-bit length field allow up to about 32,767 frames. Perl's default C stack accommodates only a few thousand frames, so decoding overruns the stack and the process receives SIGSEGV.

Root Cause

The root cause is uncontrolled recursion in a message decoder driven by attacker-controlled offsets. The code lacks a maximum pointer-chain depth and defers cache population until after recursion, so the first traversal of any chain is unbounded.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends a single crafted DNS message to any endpoint whose Perl code calls Net::DNS::Packet->new(\$wire) on the wire data. TCP transport maximizes exploitability because the larger message ceiling permits longer pointer chains.

No verified public exploit code is currently available. Refer to the RT Ticket #179946 and the OpenWall OSS Security Update for technical write-ups of the compression-chain construction.

Detection Methods for CVE-2026-64194

Indicators of Compromise

Unexpected SIGSEGV or abnormal termination of Perl processes that parse DNS traffic, including resolvers, mail filters, and monitoring agents.
DNS messages containing unusually dense sequences of two-byte compression pointers (0xC0 prefix) with strictly decreasing targets.
TCP DNS responses approaching the 65,535-byte length ceiling from untrusted upstreams.

Detection Strategies

Inspect DNS packet captures for names whose label-parsing sequence consists almost entirely of compression pointers rather than length-prefixed labels.
Correlate Perl process crashes with inbound DNS traffic timestamps in host and network telemetry.
Deploy IDS or DNS-aware proxies that count compression pointer hops per name and alert when the count exceeds a small threshold, such as 16.

Monitoring Recommendations

Enable core dump collection on hosts running Net::DNS-based services to confirm stack overflow as the failure mode.
Ship process exit events and DNS query logs to a centralized analytics platform for correlation across affected hosts.
Track outbound queries from vulnerable services to detect adversary-controlled authoritative servers returning malicious responses.

How to Mitigate CVE-2026-64194

Immediate Actions Required

Inventory all Perl applications and system tooling that depend on Net::DNS and identify installed versions.
Upgrade Net::DNS to the fixed release candidate 1.55_01 or later, as announced on the Net-DNS Blog Release Candidate page.
Restrict DNS resolution paths for exposed services to trusted upstream resolvers until patching is complete.

Patch Information

NLnet Labs addressed the vulnerability in Net::DNS 1.55_01, tracked in the MetaCPAN Change Log. The fix enforces a bounded pointer-chain depth during name decoding, preventing stack exhaustion regardless of message size or transport.

Workarounds

Front vulnerable services with a DNS proxy that validates message structure and rejects names with excessive compression pointer chains.
Run Perl processes that parse untrusted DNS with a supervisor that auto-restarts on crash to reduce outage duration.
Limit inbound DNS to UDP where feasible, reducing the maximum achievable chain length compared to TCP.

bash

# Upgrade Net::DNS from CPAN to the patched release
cpanm NLNETLABS/Net-DNS-1.55_01.tar.gz

# Verify installed version
perl -MNet::DNS -e 'print $Net::DNS::VERSION, "\n"'