Security Advisories (5)
CVE-2007-6341 (2008-02-08)

Allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response.

CVE-2007-3409 (2007-06-26)

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

CVE-2007-3377 (2007-06-25)

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

CVE-2026-64193 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVE-2026-64194 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

NAME

Net::DNS::Question - DNS question class

SYNOPSIS

use Net::DNS::Question

DESCRIPTION

A Net::DNS::Question object represents a record in the question section of a DNS packet.

METHODS

new

$question = Net::DNS::Question->new("example.com", "MX", "IN");

Creates a question object from the domain, type, and class passed as arguments.

qname, zname

print "qname = ", $question->qname, "\n";
print "zname = ", $question->zname, "\n";

Returns the domain name. In dynamic update packets, this field is known as zname and refers to the zone name.

qtype, ztype

print "qtype = ", $question->qtype, "\n";
print "ztype = ", $question->ztype, "\n";

Returns the record type. In dymamic update packets, this field is known as ztype and refers to the zone type (must be SOA).

qclass, zclass

print "qclass = ", $question->qclass, "\n";
print "zclass = ", $question->zclass, "\n";

Returns the record class. In dynamic update packets, this field is known as zclass and refers to the zone's class.

print

$question->print;

Prints the question record on the standard output.

string

print $qr->string, "\n";

Returns a string representation of the question record.

data

$qdata = $question->data($packet, $offset);

Returns the question record in binary format suitable for inclusion in a DNS packet.

Arguments are a Net::DNS::Packet object and the offset within that packet's data where the Net::DNS::Question record is to be stored. This information is necessary for using compressed domain names.

COPYRIGHT

Copyright (c) 1997-2002 Michael Fuhr. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

perl(1), Net::DNS, Net::DNS::Resolver, Net::DNS::Packet, Net::DNS::Update, Net::DNS::Header, Net::DNS::RR, RFC 1035 Section 4.1.2