Security Advisories (2)
CVE-2026-64193 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVE-2026-64194 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

NAME

Net::DNS::ZoneFile - DNS zone file

SYNOPSIS

    use Net::DNS::ZoneFile;

    $zonefile = new Net::DNS::ZoneFile( 'named.example' );

    while ( $rr = $zonefile->read ) {
	$rr->print;
    }

    @zone = $zonefile->read;

DESCRIPTION

Each Net::DNS::ZoneFile object instance represents a zone file together with any subordinate files introduced by the $INCLUDE directive. Zone file syntax is defined by RFC1035.

A program may have multiple zone file objects, each maintaining its own independent parser state information.

The parser supports both the $TTL directive defined by RFC2308 and the BIND $GENERATE syntax extension.

All RRs in a zone file must have the same class, which may be specified for the first RR encountered and is then propagated automatically to all subsequent records.

METHODS

new

$zonefile = new Net::DNS::ZoneFile( 'filename', ['example.com'] );

$handle   = new IO::File( 'filename', '<:encoding(ISO8859-7)' );
$zonefile = new Net::DNS::ZoneFile( $handle, ['example.com'] );

The new() constructor returns a Net::DNS::ZoneFile object which represents the zone file specified in the argument list.

The specified file or file handle is open for reading and closed when exhausted or all references to the ZoneFile object cease to exist.

The optional second argument specifies $ORIGIN for the zone file.

Character encoding is specified indirectly by creating a file handle with the desired encoding layer, which is then passed as an argument to new(). The specified encoding is propagated to files introduced by $include directives.

read

$rr = $zonefile->read;
@rr = $zonefile->read;

When invoked in scalar context, read() returns a Net::DNS::RR object representing the next resource record encountered in the zone file, or undefined if end of data has been reached.

When invoked in list context, read() returns the list of Net::DNS::RR objects in the order that they appear in the zone file.

Comments and blank lines are silently disregarded.

$INCLUDE, $ORIGIN, $TTL and $GENERATE directives are processed transparently.

name

$filename = $zonefile->name;

Returns the name of the current zone file. Embedded $INCLUDE directives will cause this to differ from the filename argument supplied when the object was created.

line

$line = $zonefile->line;

Returns the number of the last line read from the current zone file.

origin

$origin = $zonefile->origin;

Returns the fully qualified name of the current origin within the zone file.

ttl

$ttl = $zonefile->ttl;

Returns the default TTL as specified by the $TTL directive.

COMPATIBILITY WITH Net::DNS::ZoneFile 1.04

Applications which depended on the defunct Net::DNS::ZoneFile 1.04 CPAN distribution will continue to operate with minimal change using the compatibility interface described below.

use Net::DNS::ZoneFile;

$listref = Net::DNS::ZoneFile->read( $filename );
$listref = Net::DNS::ZoneFile->read( $filename, $include_dir );

$listref = Net::DNS::ZoneFile->readfh( $handle, $include_dir );

$listref = Net::DNS::ZoneFile->parse(  $string );
$listref = Net::DNS::ZoneFile->parse(  $string, $include_dir );
$listref = Net::DNS::ZoneFile->parse( \$string, $include_dir );

$_->print for @$listref;

The optional second argument specifies the default path for filenames. The current working directory is used by default.

Although not available in the original implementation, the RR list can be obtained directly by calling any of these methods in list context.

@rr = Net::DNS::ZoneFile->read( $filename, $include_dir );

read

$listref = Net::DNS::ZoneFile->read( $filename, $include_dir );
@rr = Net::DNS::ZoneFile->read( $filename, $include_dir );

read() parses the specified zone file and returns a reference to the list of Net::DNS::RR objects representing the RRs in the file. The return value is undefined if the zone data can not be parsed.

When called in list context, the partial result is returned if an error is encountered by the parser.

readfh

$listref = Net::DNS::ZoneFile->readfh( $handle, $include_dir );

readfh() parses data from the specified file handle and returns a reference to the list of Net::DNS::RR objects representing the RRs in the file.

parse

$listref = Net::DNS::ZoneFile->parse(  $string, $include_dir );
$listref = Net::DNS::ZoneFile->parse( \$string, $include_dir );

parse() interprets the zone file text in the argument string and returns a reference to the list of Net::DNS::RR objects representing the RRs.

ACKNOWLEDGEMENTS

This package is designed as an improved and compatible replacement for Net::DNS::ZoneFile 1.04 which was created by Luis Munoz in 2002 as a separate CPAN module.

The present implementation is the result of an agreement to merge our two different approaches into one package integrated into Net::DNS. The contribution of Luis Munoz is gratefully acknowledged.

Thanks are also due to Willem Toorop for his constructive criticism of the initial version and invaluable assistance during testing.

COPYRIGHT

Copyright (c)2011-2012 Dick Franks.

All rights reserved.

LICENSE

Permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of the author not be used in advertising or publicity pertaining to distribution of the software without specific prior written permission.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

SEE ALSO

perl, Net::DNS, Net::DNS::RR, RFC1035 Section 5.1, RFC2308, BIND 9 Administrator Reference Manual