Skip to content
Fencer Vulns
high 7.5

CVE-2026-81928 json

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record

published 2026-09-01 2 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-69727

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.

sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.

The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.

Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

Patch / fix

  • libnet-dns-perl Debian 14 1.57-1

debian advisories DEBIAN-CVE-2026-81928

  • perl-Net-DNS RHEL 8 1.15-2.el8_10
  • perl-Net-DNS RHEL 9 1.29-6.el9_8.1
  • perl-Net-DNS-Nameserver RHEL 9 1.29-6.el9_8.1

red hat advisories RHSA-2026:68787RHSA-2026:68786

  • perl-Net-DNS SLE Module for Basesystem 15 SP7 1.14-150000.3.6.1
  • perl-Net-DNS SLES LTSS Extended Security 12 SP5 0.73-5.6.1

suse advisories SUSE-SU-2026:4086-1SUSE-SU-2026:4065-1

  • perl-Net-DNS openSUSE Leap 16.0 1.570.0-bp160.1.1
  • perl-Net-DNS openSUSE Tumbleweed 1.570.0-1.1

opensuse advisories openSUSE-SU-2026:21859-1openSUSE-SU-2026:11708-1

  • perl-Net-DNS AlmaLinux 9 1.29-6.el9_8.1
  • perl-Net-DNS-Nameserver AlmaLinux 9 1.29-6.el9_8.1
  • perl-Net-DNS AlmaLinux 8 1.15-2.el8_10

almalinux advisories ALSA-2026:68786ALSA-2026:68787

  • perl-Net-DNS Rocky Linux 9 1.29-6.el9_8.1
  • perl-Net-DNS Rocky Linux 8 1.15-2.el8_10

rocky linux advisories RLSA-2026:68786RLSA-2026:68787

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81928 updated cvss 7.5

perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records

  • Red Hat Enterprise Linux 6 perl-Net-DNS, perl-Net-DNS-Nameserver
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 perl-Net-DNS, perl-Net-DNS-Nameserver
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) perl-Net-DNS 1.15-2.el8_10
    fixed: vendor fix RHSA-2026:68787
  • Red Hat Enterprise Linux AppStream (v. 9) perl-Net-DNS 1.29-6.el9_8.1 Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) perl-Net-DNS-Nameserver 1.29-6.el9_8.1
    fixed: vendor fix RHSA-2026:68786

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.