CVE-2026-81928: CWE-674 Uncontrolled Recursion
Description
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Net::DNS versions prior to 1.57 for Perl contain a vulnerability (CWE-674) due to uncontrolled recursion in the sig_data function during message re-encoding when a TSIG record is misplaced in the answer or authority section. The function removes TSIG records only from the additional section, so TSIGs in other sections remain and cause repeated re-encoding without termination. This recursion is triggered only when the decoded TSIG has an empty MAC, as a valid MAC prevents the signing step. The vulnerability can be exploited by sending a crafted DNS message with a misplaced TSIG record, leading to memory exhaustion and process termination after fewer than 100 bytes are processed. RFC 8945 section 5.2 mandates dropping such messages, but the current implementation only warns and retains the record, enabling the recursion.
Potential Impact
Successful exploitation results in memory exhaustion and termination of the affected process, causing denial of service. There is no impact on confidentiality or integrity. The vulnerability affects systems using Net::DNS Perl module versions before 1.57 that re-encode DNS messages containing misplaced TSIG records, such as DNS forwarders or proxies. Normal decoded messages that are not re-encoded are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of Net::DNS in environments where messages are re-encoded, or implement filtering to drop messages with misplaced TSIG records as per RFC 8945 section 5.2. Monitor vendor channels for official patches or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-08-27T18:31:50.335Z
- State
- PUBLISHED
Threat ID: 6a975e4facd9273b49544ecf
Added to database: 09/01/2026, 23:22:55 UTC
Last enriched: 09/17/2026, 02:49:18 UTC
Last updated: 10/17/2026, 22:23:32 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.