CVE-2026-82309: CWE-770 Allocation of Resources Without Limits or Throttling

The vulnerability in Robots::Validate versions >=0.3.2 and <0.3.11 arises from the _check_dns function issuing unbounded outbound DNS queries during validation. The function performs a PTR query for the client address, then issues forward DNS queries for each returned name until one resolves back to the original address. Because the client controls the reverse DNS zone, it can craft PTR responses with many names, causing the module to perform many synchronous DNS queries without any limit. This can lead to resource exhaustion due to uncontrolled DNS query volume. The DNS queries bypass local caching because each forward name is distinct and client-chosen, forcing resolution against authoritative servers.

The impact is limited to resource exhaustion on the system performing validation due to unbounded synchronous DNS queries. Confidentiality and integrity impacts are low as the vulnerability does not allow data disclosure or modification. Availability could be affected if the system is overwhelmed by DNS query processing. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure by restricting or validating client-controlled reverse DNS data or disabling DNS validation if feasible. Monitoring DNS query volume may help detect exploitation attempts.