https://bugzilla.redhat.com/show_bug.cgi?id=2509705
Bug ID: 2509705
Summary: CVE-2026-64194 perl-Net-DNS: Net::DNS: Denial of
Service via crafted DNS compression pointers
[epel-all]
Product: Fedora EPEL
Version: epel10
Status: NEW
Whiteboard: {"flaws": ["acc47f81-917b-4228-8bb2-8574588bb17d"]}
Component: perl-Net-DNS
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected],
[email protected], [email protected]
Blocks: 2502952
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS
compression pointer chains.
Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing
into itself with no depth limit. It is possible to construct a name which
saturates the call stack (at least with larger TCP responses), leading to a
potential Denial of Service.
The guard `$link < $offset` prevents forward and circular chains, but still
allows arbitrarily long backward chains. The per-offset cache (`$cache`) is
populated at the start of each call and short-circuits only re-traverses of the
same offset - the initial descent through a fresh chain still recurses at full
depth.
A crafted packet can chain two-byte compression pointers so that each one
points two bytes earlier than the previous, producing a chain length of `offset
/ 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191
recursive frames. For a TCP DNS message the limit is the 16-bit length field
(~32767 frames). Perl's default C stack handles only a few thousand frames;
beyond that the process receives SIGSEGV or similar, which is a
denial-of-service for any application parsing untrusted DNS data.
The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any
point where the library decodes a DNS message from the network.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2509705
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202509705%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
