/ 
Net-DNS-0.14 UNAUTHORIZED RELEASE
/ Net::DNS::Packet
Security Advisories (5)
CVE-2007-6341 (2008-02-08)

Allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response.

CVE-2007-3409 (2007-06-26)

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

CVE-2007-3377 (2007-06-25)

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

CVE-2026-64193 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVE-2026-64194 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

NAME

Net::DNS::Packet - DNS packet object class

SYNOPSIS

use Net::DNS::Packet;

DESCRIPTION

A Net::DNS::Packet object represents a DNS packet.

METHODS

new

$packet = new Net::DNS::Packet(\$data);
$packet = new Net::DNS::Packet(\$data, 1);  # set debugging

$packet = new Net::DNS::Packet("foo.com");
$packet = new Net::DNS::Packet("foo.com", "MX", "IN");

($packet, $err) = new Net::DNS::Packet(\$data);

If passed a reference to a scalar containing DNS packet data, new creates a packet object from that data. A second argument can be passed to turn on debugging output for packet parsing.

If passed a domain, type, and class, new creates a packet object appropriate for making a DNS query for the requested information. The type and class can be omitted; they default to A and IN.

If called in array context, returns a packet object and an error string. The error string will only be defined if the packet object is undefined (i.e., couldn't be created).

Returns undef if unable to create a packet object (e.g., if the packet data is truncated).

data

$data = $packet->data;

Returns the packet data in binary format, suitable for sending to a nameserver.

$header = $packet->header;

Returns a Net::DNS::Header object representing the header section of the packet.

question, zone

@question = $packet->question;

Returns a list of Net::DNS::Question objects representing the question section of the packet.

In dynamic update packets, this section is known as zone and specifies the zone to be updated.

answer, pre, prerequisite

@answer = $packet->answer;

Returns a list of Net::DNS::RR objects representing the answer section of the packet.

In dynamic update packets, this section is known as pre or prerequisite and specifies the RRs or RRsets which must or must not preexist.

authority, update

@authority = $packet->authority;

Returns a list of Net::DNS::RR objects representing the authority section of the packet.

In dynamic update packets, this section is known as update and specifies the RRs or RRsets to be added or delted.

additional

@additional = $packet->additional;

Returns a list of Net::DNS::RR objects representing the additional section of the packet.

print

$packet->print;

Prints the packet data on the standard output in an ASCII format similar to that used in DNS zone files.

string

print $packet->string;

Returns a string representation of the packet.

answerfrom

print "packet received from ", $packet->answerfrom, "\n";

Returns the IP address from which we received this packet. User-created packets will return undef for this method.

answersize

print "packet size: ", $packet->answersize, " bytes\n";

Returns the size of the packet in bytes as it was received from a nameserver. User-created packets will return undef for this method (use length $packet->data instead).

push

$packet->push("pre", $rr);
$packet->push("update", $rr);
$packet->push("additional", $rr);

$packet->push("update", $rr1, $rr2, $rr3);
$packet->push("update", @rr);

Adds RRs to the specified section of the packet.

dn_comp

$compname = $packet->dn_comp("foo.bar.com", $offset);

Returns a domain name compressed for a particular packet object, to be stored beginning at the given offset within the packet data. The name will be added to a running list of compressed domain names for future use.

dn_expand

use Net::DNS::Packet qw(dn_expand);
($name, $nextoffset) = dn_expand(\$data, $offset);

($name, $nextoffset) = Net::DNS::Packet::dn_expand(\$data, $offset);

Expands the domain name stored at a particular location in a DNS packet. The first argument is a reference to a scalar containing the packet data. The second argument is the offset within the packet where the (possibly compressed) domain name is stored.

Returns the domain name and the offset of the next location in the packet.

Returns (undef, undef) if the domain name couldn't be expanded.

COPYRIGHT

Copyright (c) 1997 Michael Fuhr. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

perl(1), Net::DNS, Net::DNS::Resolver, Net::DNS::Update, Net::DNS::Header, Net::DNS::Question, Net::DNS::RR, RFC 1035 Section 4.1, RFC 2136 Section 2