CVE-2026-64194 – Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

CVE ID :CVE-2026-64194

Published : July 20, 2026, 7:17 p.m. | 27 minutes ago

Description :Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.

The guard `$link new($wire)` i.e. any point where the library decodes a DNS message from the network.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…