CVE-2026-81928

Net::DNS versions before 1.57 for Perl contain an unbounded recursion (CWE-674) in its sig_data routine that can exhaust memory and terminate the host process. An attacker triggers it by sending a DNS message with a TSIG record misplaced in the answer or authority section; decoding only logs a 'misplaced or corrupt TSIG' warning and keeps the record, and when the application then re-encodes the decoded message (e.g., a forwarder, proxy, or signer) and the TSIG carries an empty MAC, sig_data re-enters itself with no termination condition. The result is a remotely exploitable, unauthenticated denial of service in which fewer than 100 bytes on the wire can exhaust available memory. Only code that re-encodes messages it has decoded is affected, such as Perl-based DNS forwarders, proxies, and middleware; pure decoders/responders that never re-encode are unaffected. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.5%.

What to do: Upgrade to Net::DNS 1.57 or later. Audit whether your Perl services re-encode decoded DNS messages (forwarders, proxies, DNSSEC/TSIG signers) — decode-only applications are not affected. As an interim measure, have fronting code drop messages whose TSIG is not the last record on the wire, as RFC 8945 section 5.2 requires, and monitor process memory for abnormal growth.