CVE-2026-81928

Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.57

Description Memory exhaustion can occur due to unbounded recursion in the sig data() function when re-encoding a message containing a misplaced TSIG (Transaction Signature) record. The sig data() function signs a message by re-encoding it and removing TSIG records only from the additional section. If a TSIG record is decoded into the answer or authority section, it is not removed and is signed again, causing the encoding process to re-enter sig data() without a termination condition. This occurs when the decoded TSIG has an empty MAC (Message Authentication Code), as a recovered MAC would otherwise short-circuit the signing step. This issue specifically affects code that re-encodes a decoded message, such as a forwarder or a proxy. Because each cycle re-encodes the entire message, a packet of fewer than 100 bytes can exhaust available memory and terminate the process.

Recommendations Update Net::DNS to version 1.57 or later.