CVE-2026-81928 NLNETLABS CVE debrief

Who should care

Organizations using Net::DNS versions before 1.57 for Perl should prioritize defensive actions to address the memory exhaustion vulnerability. This includes inventory and assessment of Net::DNS installations, implementation of compensating controls, monitoring for suspicious activity, and applying vendor remediation when available.

Technical summary

The vulnerability in Net::DNS versions before 1.57 for Perl allows memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. This issue can be triggered by a decoded TSIG carrying an empty MAC, and is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. The recursion can be exploited to exhaust available memory and terminate the process.

Defensive priority

High-priority defensive actions are required to address the memory exhaustion vulnerability in Net::DNS versions before 1.57 for Perl.

Recommended defensive actions

• Inventory and assess Net::DNS installations for version 1.57 or later compliance.
• Implement compensating controls to detect and prevent exploitation.
• Monitor for suspicious activity and exception tracking.
• Apply vendor remediation when available.
• Verify and retest affected systems.

Evidence notes

The vulnerability allows memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. A decoded TSIG carrying an empty MAC can trigger the recursion. The issue is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.