CVE-2026-64194

{
  "id": "CVE-2026-64194",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-20T19:17:30.157",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet->new(\\$wire)` i.e. any point where the library decodes a DNS message from the network."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::DNS hasta la 1.55 para Perl permiten la denegación de servicio a través de cadenas profundas de punteros de compresión DNS.\n\nNet::DNS::DomainName::decode sigue los punteros de compresión de RFC 1035 recursando en sí mismo sin límite de profundidad. Es posible construir un nombre que sature la pila de llamadas (al menos con respuestas TCP más grandes), lo que lleva a una potencial denegación de servicio.\n\nLa protección “$link < $offset” previene cadenas hacia adelante y circulares, pero aún permite cadenas hacia atrás arbitrariamente largas. La caché por desplazamiento (“$cache”) se rellena al inicio de cada llamada y solo evita la repetición de recorridos del mismo desplazamiento; el descenso inicial a través de una cadena nueva aún recurre a profundidad completa.\n\nUn paquete manipulado puede encadenar punteros de compresión de dos bytes de modo que cada uno apunta dos bytes antes que el anterior, produciendo una longitud de cadena de “offset / 2”. Para el campo de puntero de 14 bits (desplazamiento máximo 16383), esto da hasta ~8191 marcos recursivos. Para un mensaje DNS TCP, el límite es el campo de longitud de 16 bits (~32767 marcos). La pila C predeterminada de Perl maneja solo unos pocos miles de marcos; más allá de eso, el proceso recibe SIGSEGV o similar, lo cual es una denegación de servicio para cualquier aplicación que analice datos DNS no confiables.\n\nLa vulnerabilidad se activa por “Net::DNS::Packet  ->  new(\\$wire)”, es decir, cualquier punto donde la biblioteca decodifica un mensaje DNS de la red."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "NLNETLABS",
          "product": "Net::DNS",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Net-DNS",
          "programFiles": [
            "lib/Net/DNS/DomainName.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::DNS::DomainName::decode"
            }
          ],
          "repo": "https://www.net-dns.org/svn/net-dns/",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.55",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T18:55:36.580996Z",
          "id": "CVE-2026-64194",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}