CVE-2026-64194
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.
Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.
The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.
A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.
The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.
CSIRTS triage
- What
- Two vulnerabilities in the Perl DNS module could allow denial of service or remote code execution.
- Who is affected
- Perl applications and systems using libnet-dns-perl for DNS operations.
- Urgency
- Remediate immediately due to remote code execution vulnerability.
- Action
- Update libnet-dns-perl to the patched version from DSA-6459-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-64194
Get an email if CVE-2026-64194 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all EPSS-scored CVEs.
Advisory coverage (2)
- unknownDSA-6459-1 libnet-dns-perl - security updatedebian · 2026-08-22
- highCVE-2026-64194: Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression point…nvd · 2026-07-20
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-64194)