CVE catalog

CVE-2026-81928

Net::DNS versions before 1.57 for Perl allow memory…

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Sep 1, 2026, 11:14:52 PM UTC
Updated: Sep 2, 2026, 12:18:26 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.68% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "libnet-dns-perl",
      "status": "fixed",
      "release": "sid",
      "version": "1.57-1"
    },
    {
      "name": "libnet-dns-perl",
      "status": "fixed",
      "release": "forky",
      "version": "1.57-1"
    },
    {
      "name": "libnet-dns-perl",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.56-0+deb13u1"
    },
    {
      "name": "libnet-dns-perl",
      "status": "vulnerable",
      "release": "trixie-security",
      "version": "1.56-0+deb13u1"
    },
    {
      "name": "libnet-dns-perl",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.36-1"
    },
    {
      "name": "libnet-dns-perl",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "1.36-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "libnet-dns-perl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.57-1"
    },
    {
      "bug": null,
      "name": "libnet-dns-perl",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.57-1"
    },
    {
      "bug": null,
      "name": "libnet-dns-perl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "libnet-dns-perl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "perl-Net-DNS",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14-150000.3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp7",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.14-150000.3.6.1",
      "provider_record_id": "SUSE-SU-2026:4086-1"
    },
    {
      "name": "perl-Net-DNS",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.73-5.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server ltss extended security 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "0.73-5.6.1",
      "provider_record_id": "SUSE-SU-2026:4065-1"
    },
    {
      "name": "perl-Net-DNS",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.570.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.570.0-1.1",
      "provider_record_id": "OPENSUSE-SU-2026:11708-1"
    }
  ]
}

Publisher notes

[trixie] libnet-dns-perl: Minor issue [bookworm] libnet-dns-perl: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libnet-dns-perl]Unknown
Details (4)
- 1.36-1 · all · bookworm
  Affected
  nvd · libnet-dns-perl · debian · bookworm; nvd · libnet-dns-perl · debian · 12
- 1.36-1 · all · bookworm
  Affected
  nvd · libnet-dns-perl · debian · bookworm; nvd · libnet-dns-perl · debian · 12
- 1.36-1+deb12u1 · all · bookworm-security
  Affected
  nvd · libnet-dns-perl · debian · bookworm; nvd · libnet-dns-perl · debian · 12
- 1.36-1+deb12u1 · all · bookworm-security
  Affected
  nvd · libnet-dns-perl · debian · bookworm; nvd · libnet-dns-perl · debian · 12

[Debian 13 (Trixie)]

[libnet-dns-perl]Unknown
Details (4)
- 1.50-1 · all · trixie
  Affected
  nvd · libnet-dns-perl · debian · 13
- 1.50-1 · all · trixie
  Affected
  nvd · libnet-dns-perl · debian · 13
- 1.56-0+deb13u1 · all · trixie-security
  Affected
  nvd · libnet-dns-perl · debian · 13
- 1.56-0+deb13u1 · all · trixie-security
  Affected
  nvd · libnet-dns-perl · debian · 13

[openSUSE Tumbleweed]

[perl-Net-DNS]Unknown
Source package: [perl-Net-DNS]
Details (1)
- 1.560.0-1.1 · noarch · tumbleweed
  Affected · Fixed: 1.570.0-1.1
  nvd · perl-Net-DNS · opensuse · tumbleweed

Observed: Oct 27, 2026, 6:57:09 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]