CVE-2026-81928 Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
Attackers can cause memory exhaustion and process termination in Perl Net::DNS applications by sending crafted DNS messages with misplaced TSIG records.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81928?
CVE-2026-81928 is a high-severity denial of service vulnerability in perl-Net-DNS, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.
The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.
Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
Weakness: CWE-674
Which versions are affected by CVE-2026-81928?
Linux distribution packages (11)
perl-Net-DNS AlmaLinux:8 | All versions | 1.15-2.el8_10 |
perl-Net-DNS AlmaLinux:9 | All versions | 1.29-6.el9_8.1 |
perl-Net-DNS-Nameserver AlmaLinux:9 | All versions | 1.29-6.el9_8.1 |
perl-Net-DNS Red Hat:enterprise_linux:8::appstream | All versions | 0:1.15-2.el8_10 |
perl-Net-DNS Red Hat:enterprise_linux:9::appstream | All versions | 0:1.29-6.el9_8.1 |
perl-Net-DNS-Nameserver Red Hat:enterprise_linux:9::crb | All versions | 0:1.29-6.el9_8.1 |
perl-Net-DNS Rocky Linux:8 | All versions | 0:1.15-2.el8_10 |
perl-Net-DNS Rocky Linux:9 | All versions | 0:1.29-6.el9_8.1 |
perl-Net-DNS SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.14-150000.3.6.1 |
perl-Net-DNS SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.73-5.6.1 |
perl-Net-DNS openSUSE:Tumbleweed | All versions | 1.570.0-1.1 |
How do I fix CVE-2026-81928?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-81928 being exploited?
There is no known exploitation of CVE-2026-81928 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:68786, ALSA-2026:68787, DEBIAN-CVE-2026-81928, GHSA-x88w-xx7m-3m5f, RHSA-2026:68786, RHSA-2026:68787 and 6 more.