CVE-2026-81928

A flaw was found in Net::DNS versions before 1.57 for Perl. An attacker can cause a denial of service (DoS) by sending a specially crafted DNS message with a misplaced Transaction Signature (TSIG) record. When a system using Net::DNS, such as a forwarder or proxy, attempts to re-encode this message, it can lead to unbounded recursion and memory exhaustion, ultimately terminating the process. This vulnerability arises because the sig_data function fails to properly remove TSIG records from all sections of a DNS message, violating RFC 8945 section 5.2 requirements.

Red Hat has evaluated this vulnerability as having an Important severity impact because unauthenticated remote attackers can induce process crashes and memory exhaustion with minimal network traffic. In Red Hat Enterprise Linux, the perl-Net-DNS package is a DNS resolver library, and the vast majority of consumers act purely as DNS clients that parse replies without re-encoding them, remaining unaffected. Exploitation is restricted to specialized scenarios where custom Perl-based daemons act as DNS proxies, forwarders, or packet relays that re-serialize decoded network packets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to DNS services utilizing perl-Net-DNS to trusted clients or internal networks only, thereby limiting exposure. If the DNS service is not required to act as a forwarder or proxy, disable this functionality to prevent the vulnerable code path from being exercised.