Description

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-02T00:18:26.147Z",
  "pubdate": "2026-09-02T00:18:26.147Z",
  "executiveSummary": "Net::DNS versions prior to 1.57 are vulnerable to a critical memory exhaustion flaw resulting from unbounded recursion during message re-encoding.\nThe vulnerability arises when the sig_data function processes a maliciously crafted DNS packet containing a misplaced TSIG record within the answer or authority sections.\nThe failure to adhere to RFC 8945 section 5.2, which mandates dropping messages with malformed or misplaced TSIG records, allows an attacker to trigger an infinite recursive re-encoding cycle.\nThis vulnerability primarily impacts systems that act as forwarders, proxies, or any application that decodes and subsequently re-encodes DNS messages using the affected library.\nSuccessful exploitation leads to rapid consumption of system memory, resulting in a Denial of Service (DoS) and immediate process termination.\nThe attack is highly efficient, requiring less than 100 bytes of data on the wire to saturate available memory resources.\nNo specific authentication or privilege escalation is required, as the vulnerability is reachable through standard network-exposed DNS processing pathways.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic of the sig_data function within Net::DNS, which is responsible for signing DNS messages. When a message is re-encoded, the implementation is designed to strip TSIG records only from the additional section of the DNS packet. However, if a TSIG record is maliciously placed in the answer or authority section, it is not removed during the re-encoding phase.\nBecause the TSIG record persists in the packet, it is processed again during the subsequent signing operation. The sig_data function re-enters itself to re-encode the message, creating a recursive loop with no termination condition. This recursion is specifically triggered when the decoded TSIG record contains an empty Message Authentication Code (MAC). If a MAC is present, the process typically short-circuits, preventing the recursive signing step; an empty MAC bypasses this protection.\nThe vulnerability is exacerbated by the library's error handling mechanism. Upon encountering a misplaced TSIG record that violates RFC 8945 section 5.2, the library catches the error, logs it as a warning, and permits the invalid record to remain in the packet buffer rather than discarding the message. This behavior allows the malformed state to persist into the re-encoding cycle.\nThe attack flow proceeds as follows: 1. An attacker sends a crafted DNS message containing a TSIG record positioned outside of the additional section. 2. The target system (proxy, forwarder, or application) decodes the packet using Net::DNS. 3. The library identifies the misplaced TSIG, issues a warning, but retains the record in the object. 4. The application triggers a re-encoding process for the message. 5. sig_data is invoked; it fails to remove the misplaced TSIG and recursively calls itself to sign the message. 6. Each recursive iteration re-encodes the entire message, leading to exponential memory allocation. 7. Given the small payload size (less than 100 bytes), memory exhaustion occurs almost instantaneously, leading to a crash of the host process.\nThis vulnerability is limited to code paths where a decoded message is subsequently re-encoded. Applications that merely decode and inspect DNS traffic without performing re-encoding or re-signing are not directly susceptible to this specific recursive loop."
}