Bug 2527155 (CVE-2026-81928)

Summary: CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Net::DNS versions before 1.57 for Perl. An attacker can cause a denial of service (DoS) by sending a specially crafted DNS message with a misplaced Transaction Signature (TSIG) record. When a system using Net::DNS, such as a forwarder or proxy, attempts to re-encode this message, it can lead to unbounded recursion and memory exhaustion, ultimately terminating the process. This vulnerability arises because the `sig_data` function fails to properly remove TSIG records from all sections of a DNS message, violating RFC 8945 section 5.2 requirements.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2529757, 2529758    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-01 23:31:25 UTC 
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.

sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.

The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.

Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.