CVE-2026-64194

Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.56

Description An issue exists where the software allows a Denial of Service via deep DNS compression pointer chains. The Net::DNS::DomainName::decode function follows RFC 1035 compression pointers by recursing into itself without a depth limit. While the guard $link < $offset prevents forward and circular chains, it allows arbitrarily long backward chains. A crafted packet can chain two-byte compression pointers to saturate the call stack, causing the process to receive a SIGSEGV (segmentation fault) or similar error. This occurs when the library decodes a DNS message from the network via Net::DNS::Packet->new($wire).

Recommendations Update Net::DNS to version 1.56 or later.