Search: CVE-2026-81928

CVE-2026-81928 is a high-severity vulnerability in Net::DNS for Perl versions before 1.57. It involves uncontrolled recursion in the sig_data function when re-encoding DNS messages containing a misplaced TSIG record. This can lead to memory exhaustion and process termination. The issue arises because TSIG records in the answer or authority sections are not removed before re-encoding, causing infinite recursion. The vulnerability affects code paths that re-encode decoded messages, such as forwarders or proxies. Decoding alone does not trigger the issue, and the recursion only occurs if the TSIG carries an empty MAC. The vulnerability has a CVSS score of 7.5 and no known exploits in the wild. No patch or remediation information is provided.