Net-DNS-1.56 (Perl module)

[Bruce Dubbs]

New minor version.

[Joe Locash]

**** 1.56 Jul 18, 2027

Fix rt.cpan.org #180088
        Documentation issue for Net::DNS::RR::RRSIG::verify()

Fix rt.cpan.org #179946
        Denial of Service via long DNS compression chains

Fix rt.cpan.org #179945
        Remote code injection via EDNS EXTENDED ERROR

Fix rt.cpan.org #179692/#176900
        UNIX.pm: Unreachable code warning using Apache/mod_perl

Fixed at 7c9c1a7925. Leaving open for SA.

[Joe Locash]

Message-ID: <7aa40a59-3e34-4f4c-b4c8-03966b181fbb@cpansec.org>
Date: Mon, 20 Jul 2026 18:56:51 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-64193: Net::DNS versions through 1.55 for Perl allow remote
 execution injection via EDNS EXTENDED ERROR


========================================================================
CVE-2026-64193                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-64193
   Distribution:  Net-DNS
       Versions:  through 1.55

       MetaCPAN:  https://metacpan.org/dist/Net-DNS
       VCS Repo:  https://www.net-dns.org/svn/net-dns/


Net::DNS versions through 1.55 for Perl allow remote execution
injection via EDNS EXTENDED ERROR

Description
-----------
Net::DNS versions through 1.55 for Perl allow remote execution
injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT
field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw
bytes and passing the result to Perl's eval. There is some escaping
done for $ and @, but not for backticks. This can be exploited for
command execution if $pkt->edns->option('EXTENDED-ERROR') is called in
array context, for example with a payload of {0:`"<command>"`} in
EXTRA-TEXT.

Problem types
-------------
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated
   Code ('Eval Injection')

Solutions
---------
Upgrade to version 1.56 or later.


References
----------
https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
https://rt.cpan.org/Ticket/Display.html?id=179945
https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes

Timeline
--------
- 2026-07-10: Issue reported publicly via RT.
- 2026-07-10: Version 1.55_01 (release candidate for version 1.56)
   published on CPAN.
- 2026-07-18: Version 1.56 published on CPAN.

Credits
-------
Steffen Ullrich, reporter

Message-ID: <5d5d51df-b111-447a-8f68-c6ac948fee4f@cpansec.org>
Date: Mon, 20 Jul 2026 18:56:09 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-64194: Net::DNS versions through 1.55 for Perl allow Denial
 of Service via deep DNS compression pointer chains


========================================================================
CVE-2026-64194                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-64194
   Distribution:  Net-DNS
       Versions:  through 1.55

       MetaCPAN:  https://metacpan.org/dist/Net-DNS
       VCS Repo:  https://www.net-dns.org/svn/net-dns/


Net::DNS versions through 1.55 for Perl allow Denial of Service via
deep DNS compression pointer chains

Description
-----------
Net::DNS versions through 1.55 for Perl allow Denial of Service via
deep DNS compression pointer chains.

Net::DNS::DomainName::decode follows RFC 1035 compression pointers by
recursing into itself with no depth limit. It is possible to construct
a name which saturates the call stack (at least with larger TCP
responses), leading to a potential Denial of Service.

The guard `$link < $offset` prevents forward and circular chains, but
still allows arbitrarily long backward chains. The per-offset cache
(`$cache`) is populated at the start of each call and short-circuits
only re-traverses of the same offset - the initial descent through a
fresh chain still recurses at full depth.

A crafted packet can chain two-byte compression pointers so that each
one points two bytes earlier than the previous, producing a chain
length of `offset / 2`. For the 14-bit pointer field (max offset 16383)
this gives up to ~8191 recursive frames. For a TCP DNS message the
limit is the 16-bit length field (~32767 frames). Perl's default C
stack handles only a few thousand frames; beyond that the process
receives SIGSEGV or similar, which is a denial-of-service for any
application parsing untrusted DNS data.

The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e.
any point where the library decodes a DNS message from the network.

Problem types
-------------
- CWE-674 Uncontrolled Recursion

Solutions
---------
Upgrade to version 1.56 or later.


References
----------
https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
https://rt.cpan.org/Ticket/Display.html?id=179946
https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes

Timeline
--------
- 2026-07-10: Issue reported publicly via RT.
- 2026-07-10: Version 1.55_01 (release candidate for version 1.56)
   published on CPAN.
- 2026-07-18: Version 1.56 published on CPAN.

Credits
-------
Steffen Ullrich, reporter

[Bruce Dubbs]

Advisory sa-13.0-157 has been issued.