CVE-2026-81928 NLNETLABS CVE debrief

Who should care

Defenders responsible for DNS infrastructure, particularly those managing forwarders and proxies using Net::DNS, should assess exposure and prioritize updates. System administrators and security teams for organizations using affected versions of Net::DNS need to verify if their systems re-encode DNS messages and take appropriate action.

Why it matters

CVE-2026-81928 is a high-severity vulnerability in Net::DNS before version 1.57 for Perl, allowing memory exhaustion via unbounded recursion. It primarily affects forwarders and proxies that re-encode DNS messages. Defenders should prioritize updating to version 1.57 or later and assess exposure for systems that re-encode DNS messages.

• Memory exhaustion leading to process termination
• Potential for denial of service (DoS) through resource depletion
• Need for verification of affected versions and exposure
• Priority for updating to Net::DNS version 1.57 or later

Technical summary

The vulnerability in Net::DNS before version 1.57 for Perl allows memory exhaustion through unbounded recursion in the sig_data function. This occurs when re-encoding a message with a misplaced TSIG record, particularly when the TSIG has an empty MAC. The issue primarily affects forwarders and proxies that re-encode decoded messages. An empty MAC in a decoded TSIG can lead to recursive re-encoding of the entire message, causing memory exhaustion. Fewer than 100 bytes on the wire can cause this exhaustion. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded,

Defensive priority

Defenders should prioritize updating Net::DNS to version 1.57 or later, especially for systems that re-encode DNS messages. Immediate action is required for forwarders, proxies, and any system that uses Net::DNS for DNS resolution.

Recommended defensive actions

• Update Net::DNS to version 1.57 or later
• Assess exposure for forwarders and proxies using Net::DNS
• Verify if systems re-encode DNS messages
• Monitor for unusual memory usage in affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in Net::DNS versions before 1.57. The issue arises from the handling of TSIG records during message re-encoding. An empty MAC in a decoded TSIG can lead to unbounded recursion, causing memory exhaustion. This affects systems that re-encode DNS messages, such as forwarders and proxies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.