CVE-2026-81928: Net::DNS for Perl DOS Vulnerability

CVE-2026-81928 Overview

CVE-2026-81928 affects Net::DNS versions before 1.57 for Perl. The vulnerability allows remote attackers to exhaust process memory through unbounded recursion in the sig_data function when re-encoding a DNS message containing a misplaced Transaction Signature (TSIG) record. The flaw resides in the interaction between the decoder, which tolerates a malformed TSIG placement with only a warning, and the signer, which fails to strip such TSIG records before recursively re-encoding the message. The issue is categorized as an uncontrolled recursion weakness [CWE-674]. Only applications that decode and then re-encode DNS messages, such as forwarders or proxies, are affected.

Critical Impact
Fewer than 100 bytes on the wire can exhaust available memory and terminate the affected Perl process, producing a denial-of-service condition against DNS forwarders and proxies built on Net::DNS.

Affected Products

Net::DNS for Perl versions prior to 1.57
Perl-based DNS forwarders using Net::DNS
Perl-based DNS proxies using Net::DNS

Discovery Timeline

2026-09-02 - CVE-2026-81928 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81928

Vulnerability Analysis

The vulnerability stems from an unbounded recursion path in sig_data, the Net::DNS routine that signs a DNS message by re-encoding it. During signing, sig_data removes TSIG records only from the additional section of the packet. A TSIG record decoded into the answer or authority section survives this cleanup step and is signed again, causing the encoder to re-enter sig_data with no termination condition.

The decoder contributes to the flaw by accepting messages that RFC 8945 requires it to reject. When a TSIG appears somewhere other than the final position on the wire, the decoder raises a misplaced or corrupt TSIG error. That error is caught, downgraded to a warning, and the malformed record is left in place inside the packet. RFC 8945 Section 5.2 explicitly requires the message to be dropped.

The recursion is triggered only when the decoded TSIG carries an empty Message Authentication Code (MAC), because a MAC recovered from the wire short-circuits the signing step. Each recursive cycle re-encodes the full message, so memory consumption grows rapidly. Message direction does not matter: a query reaches the same code path as a response.

Root Cause

Two cooperating defects create the condition. First, the decoder tolerates misplaced TSIG records instead of dropping the message as required by IETF RFC 8945 Section 5.2. Second, sig_data strips TSIG records only from the additional section, leaving misplaced TSIG records in the answer or authority sections to trigger recursive signing without a base case.

Attack Vector

An unauthenticated remote attacker sends a crafted DNS message containing a TSIG record placed outside the additional section and carrying an empty MAC. When a Net::DNS-based forwarder or proxy decodes the packet and re-encodes it for onward transmission, sig_data recurses indefinitely. Fewer than 100 bytes on the wire are sufficient to exhaust the memory of the affected process. See MetaCPAN TSIG source at lines 245-262 and lines 62-73 for the affected code paths.

// No verified proof-of-concept code is published for CVE-2026-81928.
// See the OpenWall discussion and CPAN ticket for technical details.

Detection Methods for CVE-2026-81928

Indicators of Compromise

Perl processes running DNS forwarders or proxies that terminate with out-of-memory errors shortly after receiving DNS traffic.
Log entries containing the string misplaced or corrupt TSIG originating from Net::DNS warning handlers.
Sudden spikes in resident memory usage of Perl processes handling DNS message re-encoding.

Detection Strategies

Inventory Perl deployments and identify any use of the Net::DNS module with a version lower than 1.57.
Instrument DNS forwarders and proxies to alert when process memory grows beyond a defined baseline within a short time window.
Inspect DNS traffic for packets in which a TSIG record does not appear as the final resource record on the wire.

Monitoring Recommendations

Forward Perl warning output and process termination events to a centralized log platform for correlation with DNS traffic.
Monitor DNS gateway hosts for repeated process restarts, which suggest a memory-exhaustion loop.
Track inbound DNS packet sizes and rates against services known to run Net::DNS-based tooling.

How to Mitigate CVE-2026-81928

Immediate Actions Required

Upgrade Net::DNS to version 1.57 or later on all systems that decode and re-encode DNS messages.
Restart Perl-based DNS forwarders and proxies after the upgrade to load the patched module.
Restrict inbound DNS traffic to trusted sources where feasible until patching is complete.

Patch Information

The maintainers address the issue in Net::DNS 1.57. Review the Net-DNS 1.57 changes on MetaCPAN and the tracking record at CPAN Ticket #181125. Additional discussion is available on the OpenWall oss-security list.

Workarounds

Filter DNS packets at the network edge to drop messages where a TSIG record is not the final resource record on the wire.
Disable message re-encoding paths in affected Perl applications where operationally acceptable.
Apply per-process memory limits (for example, using ulimit or systemd MemoryMax) so a runaway signer cannot consume host memory.

bash

# Upgrade Net::DNS to the fixed release
cpan install NLNETLABS/Net-DNS-1.57.tar.gz

# Verify installed version
perl -MNet::DNS -e 'print $Net::DNS::VERSION, "\n"'

# Enforce a process memory ceiling for a Perl DNS service under systemd
# [Service]
# MemoryMax=512M