CVE-2026-64194

A flaw was found in Net::DNS. A remote attacker can exploit this vulnerability by sending a specially crafted DNS packet with deep compression pointer chains. This can cause excessive recursion in the Net::DNS::DomainName::decode function, leading to stack exhaustion and a Denial of Service (DoS) for any application processing untrusted DNS data.

Contrary to the CVE description, this issue does not easily trigger an application crash via stack memory exhaustion, as the Perl interpreter handles this recursion without doing recursive function calls and by saving recursion state on the heap. It is possible to trigger a crash via out-of-(heap)-memory condition. Due to the input size being restricted via DNS protocol packet limits, such condition is only triggerable for processes with low heap memory limits. For processes with higher or no heap memory limit, this issue triggers transient limit memory usage spike.

Based on the impact described above, Red Hat has rated this issue as having Moderate security impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.