/ 
Net-DNS-1.05_04
/ Net::DNS::Packet
Security Advisories (2)
CVE-2026-64193 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVE-2026-64194 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

NAME

Net::DNS::Packet - DNS protocol packet

SYNOPSIS

use Net::DNS::Packet;

$query = new Net::DNS::Packet( 'example.com', 'MX', 'IN' );

$reply = $resolver->send( $query );

DESCRIPTION

A Net::DNS::Packet object represents a DNS protocol packet.

METHODS

new

$packet = new Net::DNS::Packet( 'example.com' );
$packet = new Net::DNS::Packet( 'example.com', 'MX', 'IN' );

$packet = new Net::DNS::Packet();

If passed a domain, type, and class, new() creates a Net::DNS::Packet object which is suitable for making a DNS query for the specified information. The type and class may be omitted; they default to A and IN.

If called with an empty argument list, new() creates an empty packet.

$packet = new Net::DNS::Packet( \$data );
$packet = new Net::DNS::Packet( \$data, 1 );	# debug

If passed a reference to a scalar containing DNS packet data, a new packet object is created by decoding the data. The optional second boolean argument enables debugging output.

Returns undef if unable to create a packet object.

Decoding errors, including data corruption and truncation, are collected in the $@ ($EVAL_ERROR) variable.

( $packet, $length ) = new Net::DNS::Packet( \$data );

If called in array context, returns a packet object and the number of octets successfully decoded.

Note that the number of RRs in each section of the packet may differ from the corresponding header value if the data has been truncated or corrupted during transmission.

data

$data = $packet->data;
$data = $packet->data( $size );

Returns the packet data in binary format, suitable for sending as a query or update request to a nameserver.

Truncation may be specified using a non-zero optional size argument.

$header = $packet->header;

Constructor method which returns a Net::DNS::Header object which represents the header section of the packet.

edns

$edns    = $packet->edns;
$version = $edns->version;
$UDPsize = $edns->size;

Auxiliary function which provides access to the EDNS protocol extension OPT RR.

reply

$reply = $query->reply( $UDPmax );

Constructor method which returns a new reply packet.

The optional UDPsize argument is the maximum UDP packet size which can be reassembled by the local network stack, and is advertised in response to an EDNS query.

question, zone

@question = $packet->question;

Returns a list of Net::DNS::Question objects representing the question section of the packet.

In dynamic update packets, this section is known as zone() and specifies the DNS zone to be updated.

answer, pre, prerequisite

@answer = $packet->answer;

Returns a list of Net::DNS::RR objects representing the answer section of the packet.

In dynamic update packets, this section is known as pre() or prerequisite() and specifies the RRs or RRsets which must or must not preexist.

authority, update

@authority = $packet->authority;

Returns a list of Net::DNS::RR objects representing the authority section of the packet.

In dynamic update packets, this section is known as update() and specifies the RRs or RRsets to be added or deleted.

additional

@additional = $packet->additional;

Returns a list of Net::DNS::RR objects representing the additional section of the packet.

print

$packet->print;

Prints the packet data on the standard output in an ASCII format similar to that used in DNS zone files.

string

print $packet->string;

Returns a string representation of the packet.

answerfrom

print "packet received from ", $packet->answerfrom, "\n";

Returns the IP address from which this packet was received. User-created packets will return undef for this method.

answersize

print "packet size: ", $packet->answersize, " bytes\n";

Returns the size of the packet in bytes as it was received from a nameserver. User-created packets will return undef for this method (use length($packet->data) instead).

push

$ancount = $packet->push( prereq => $rr );
$nscount = $packet->push( update => $rr );
$arcount = $packet->push( additional => $rr );

$nscount = $packet->push( update => $rr1, $rr2, $rr3 );
$nscount = $packet->push( update => @rr );

Adds RRs to the specified section of the packet.

Returns the number of resource records in the specified section.

Section names may be abbreviated to the first three characters.

unique_push

$ancount = $packet->unique_push( prereq => $rr );
$nscount = $packet->unique_push( update => $rr );
$arcount = $packet->unique_push( additional => $rr );

$nscount = $packet->unique_push( update => $rr1, $rr2, $rr3 );
$nscount = $packet->unique_push( update => @rr );

Adds RRs to the specified section of the packet provided that the RRs are not already present in the same section.

Returns the number of resource records in the specified section.

Section names may be abbreviated to the first three characters.

pop

my $rr = $packet->pop( 'pre' );
my $rr = $packet->pop( 'update' );
my $rr = $packet->pop( 'additional' );

Removes a single RR from the specified section of the packet.

sign_tsig

    $query = Net::DNS::Packet->new( 'www.example.com', 'A' );

    $query->sign_tsig(
		'Khmac-sha512.example.+165+01018.private',
		fudge => 60
		);

    $reply = $res->send( $query );

    $reply->verify( $query ) || die $reply->verifyerr;

Attaches a TSIG resource record object, which will be used to sign the packet (see RFC 2845).

The TSIG record can be customised by optional additional arguments to sign_tsig() or by calling the appropriate Net::DNS::RR::TSIG methods.

If you wish to create a TSIG record using a non-standard algorithm, you will have to create it yourself. In all cases, the TSIG name must uniquely identify the key shared between the parties, and the algorithm name must identify the signing function to be used with the specified key.

    $tsig = Net::DNS::RR->new(
		name		=> 'tsig.example',
		type		=> 'TSIG',
		algorithm	=> 'custom-algorithm',
		key		=> '<base64 key text>',
		sig_function	=> sub {
					  my ($key, $data) = @_;
						...
					}
		);

    $query->sign_tsig( $tsig );

The historical simplified syntax is still available, but additional options can not be specified.

$packet->sign_tsig( $key_name, $key );

The response to an inbound request is signed by presenting the request in place of the key parameter.

$response = $request->reply;
$response->sign_tsig( $request, @options );

Multi-packet transactions are signed by chaining the sign_tsig() calls together as follows:

    $opaque  =	$packet1->sign_tsig( 'Kexample.+165+13281.private' );
    $opaque  =	$packet2->sign_tsig( $opaque );
		$packet3->sign_tsig( $opaque );

The opaque intermediate object references returned during multi-packet signing are not intended to be accessed by the end-user application. Any such access is expressly forbidden.

Note that a TSIG record is added to every packet; this implementation does not support the suppressed signature scheme described in RFC2845.

verify and verifyerr

$packet->verify()		|| die $packet->verifyerr;
$reply->verify( $query )	|| die $reply->verifyerr;

Verify TSIG signature of packet or reply to the corresponding query.

$opaque  =	$packet1->verify( $query ) || die $packet1->verifyerr;
$opaque  =	$packet2->verify( $opaque );
$verifed =	$packet3->verify( $opaque ) || die $packet3->verifyerr;

The opaque intermediate object references returned during multi-packet verify() will be undefined (Boolean false) if verification fails. Access to the object itself, if it exists, is expressly forbidden. Testing at every stage may be omitted, which results in a BADSIG error on the final packet in the absence of more specific information.

sign_sig0

SIG0 support is provided through the Net::DNS::RR::SIG class. The requisite cryptographic components are not integrated into Net::DNS but reside in the Net::DNS::SEC distribution available from CPAN.

$update = new Net::DNS::Update('example.com');
$update->push( update => rr_add('foo.example.com A 10.1.2.3'));
$update->sign_sig0('Kexample.com+003+25317.private');

Execution will be terminated if Net::DNS::SEC is not available.

verify SIG0

$packet->verify( $keyrr )		|| die $packet->verifyerr;
$packet->verify( [$keyrr, ...] )	|| die $packet->verifyerr;

Verify SIG0 packet signature against one or more specified KEY RRs.

sigrr

$sigrr = $packet->sigrr() || die 'unsigned packet';

The sigrr method returns the signature RR from a signed packet or undefined if the signature is absent.

truncate

The truncate method takes a maximum length as argument and then tries to truncate the packet and set the TC bit according to the rules of RFC2181 Section 9.

The minimum maximum length that is honoured is 512 octets.

COPYRIGHT

Copyright (c)1997-2000 Michael Fuhr.

Portions Copyright (c)2002-2004 Chris Reinhardt.

Portions Copyright (c)2002-2009 Olaf Kolkman

Portions Copyright (c)2007-2015 Dick Franks

All rights reserved.

LICENSE

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of the author not be used in advertising or publicity pertaining to distribution of the software without specific prior written permission.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

SEE ALSO

perl, Net::DNS, Net::DNS::Update, Net::DNS::Header, Net::DNS::Question, Net::DNS::RR, Net::DNS::RR::TSIG, RFC1035 Section 4.1, RFC2136 Section 2, RFC2845