CVE-2026-64194

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64194", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-19T10:13:00.756Z", "datePublished": "2026-07-20T17:55:05.169Z", "dateUpdated": "2026-08-30T20:06:49.756Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-DNS", "product": "Net::DNS", "programFiles": ["lib/Net/DNS/DomainName.pm"], "programRoutines": [{"name": "Net::DNS::DomainName::decode"}], "repo": "https://www.net-dns.org/svn/net-dns/", "vendor": "NLNETLABS", "versions": [{"lessThanOrEqual": "1.55", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Steffen Ullrich"}], "descriptions": [{"lang": "en", "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-20T17:55:05.169Z"}, "references": [{"url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"}, {"tags": ["issue-tracking"], "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to version 1.56 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Issue reported publicly via RT."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Version 1.55_01 (release candidate for version 1.56) published on CPAN."}, {"lang": "en", "time": "2026-07-18T00:00:00.000Z", "value": "Version 1.56 published on CPAN."}], "title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-30T20:06:49.756Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T18:55:36.580996Z", "id": "CVE-2026-64194", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T18:56:01.149Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-30T20:06:49.756Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-64194", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T18:55:36.580996Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T18:55:57.115Z"}}], "cna": {"title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Steffen Ullrich"}], "affected": [{"repo": "https://www.net-dns.org/svn/net-dns/", "vendor": "NLNETLABS", "product": "Net::DNS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.55"}], "packageName": "Net-DNS", "programFiles": ["lib/Net/DNS/DomainName.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Net::DNS::DomainName::decode"}]}], "timeline": [{"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Issue reported publicly via RT."}, {"lang": "en", "time": "2026-07-10T00:00:00.000Z", "value": "Version 1.55_01 (release candidate for version 1.56) published on CPAN."}, {"lang": "en", "time": "2026-07-18T00:00:00.000Z", "value": "Version 1.56 published on CPAN."}], "solutions": [{"lang": "en", "value": "Upgrade to version 1.56 or later."}], "references": [{"url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"}, {"url": "https://rt.cpan.org/Ticket/Display.html?id=179946", "tags": ["issue-tracking"]}, {"url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-20T17:55:05.169Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64194", "state": "PUBLISHED", "dateUpdated": "2026-08-30T20:06:49.756Z", "dateReserved": "2026-07-19T10:13:00.756Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-20T17:55:05.169Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-DNS", "product": "Net::DNS", "programFiles": ["lib/Net/DNS/DomainName.pm"], "programRoutines": [{"name": "Net::DNS::DomainName::decode"}], "repo": "https://www.net-dns.org/svn/net-dns/", "vendor": "NLNETLABS", "versions": [{"lessThanOrEqual": "1.55", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network."}, {"lang": "es", "value": "Las versiones de Net::DNS hasta la 1.55 para Perl permiten la denegaci\u00f3n de servicio a trav\u00e9s de cadenas profundas de punteros de compresi\u00f3n DNS.\n\nNet::DNS::DomainName::decode sigue los punteros de compresi\u00f3n de RFC 1035 recursando en s\u00ed mismo sin l\u00edmite de profundidad. Es posible construir un nombre que sature la pila de llamadas (al menos con respuestas TCP m\u00e1s grandes), lo que lleva a una potencial denegaci\u00f3n de servicio.\n\nLa protecci\u00f3n \u201c$link < $offset\u201d previene cadenas hacia adelante y circulares, pero a\u00fan permite cadenas hacia atr\u00e1s arbitrariamente largas. La cach\u00e9 por desplazamiento (\u201c$cache\u201d) se rellena al inicio de cada llamada y solo evita la repetici\u00f3n de recorridos del mismo desplazamiento; el descenso inicial a trav\u00e9s de una cadena nueva a\u00fan recurre a profundidad completa.\n\nUn paquete manipulado puede encadenar punteros de compresi\u00f3n de dos bytes de modo que cada uno apunta dos bytes antes que el anterior, produciendo una longitud de cadena de \u201coffset / 2\u201d. Para el campo de puntero de 14 bits (desplazamiento m\u00e1ximo 16383), esto da hasta ~8191 marcos recursivos. Para un mensaje DNS TCP, el l\u00edmite es el campo de longitud de 16 bits (~32767 marcos). La pila C predeterminada de Perl maneja solo unos pocos miles de marcos; m\u00e1s all\u00e1 de eso, el proceso recibe SIGSEGV o similar, lo cual es una denegaci\u00f3n de servicio para cualquier aplicaci\u00f3n que analice datos DNS no confiables.\n\nLa vulnerabilidad se activa por \u201cNet::DNS::Packet -> new(\\$wire)\u201d, es decir, cualquier punto donde la biblioteca decodifica un mensaje DNS de la red."}], "id": "CVE-2026-64194", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64194", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T18:55:36.580996Z", "version": "2.0.3"}}]}, "published": "2026-07-20T19:17:30.157", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.55]"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "Net::DNS", "source": "cna", "vendor": "NLNETLABS"}, "product": "net_dns", "vendor": "nlnet_labs"}], "created": "2026-07-21T20:15:02.599408+00:00", "updated": "2026-08-01T07:15:03.372858+00:00", "vendors": ["nlnet_labs", "nlnet_labs$PRODUCT$net_dns"]}