Security Advisories (5)
CVE-2007-6341 (2008-02-08)

Allows remote attackers to cause a denial of service (program "croak") via a crafted DNS response.

CVE-2007-3409 (2007-06-26)

Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed DNS packet with self-referencing pointers, which triggers an infinite loop.

CVE-2007-3377 (2007-06-25)

Header.pm in Net::DNS before 0.60, a Perl module, (1) generates predictable sequence IDs with a fixed increment and (2) can use the same starting ID for all child processes of a forking server, which allows remote attackers to spoof DNS responses, as originally reported for qpsmtp and spamassassin.

CVE-2026-64193 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVE-2026-64194 (2026-07-20)

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

NAME

Net::DNS - Perl interface to the DNS resolver

SYNOPSIS

use Net::DNS;

DESCRIPTION

Net::DNS is a collection of Perl modules to interface with the Domain Name System (DNS) resolver. It allows the programmer to perform queries that are beyond the capabilities of gethostbyname and gethostbyaddr.

Resolver Objects

A resolver object is an instance of the Net::DNS::Resolver class. A program can have multiple resolver objects, each maintaining its own state information such as the nameservers to be queried, whether recursion is desired, etc.

Packet Objects

Net::DNS::Resolver queries return Net::DNS::Packet objects. Packet objects have five sections:

  • The header section, a Net::DNS::Header object.

  • The question section, a list of Net::DNS::Question objects.

  • The answer section, a list of Net::DNS::RR objects.

  • The authority section, a list of Net::DNS::RR objects.

  • The additional section, a list of Net::DNS::RR objects.

The Net::DNS::Update package is a front-end to Net::DNS::Packet for creating packet objects to be used in dynamic updates.

Header Objects

Net::DNS::Header objects represent the header section of a DNS packet.

Question Objects

Net::DNS::Question objects represent the query section of a DNS packet.

RR Objects

Net::DNS::RR is the base class for DNS resource record (RR) objects in the answer, authority, and additional sections of a DNS packet.

METHODS

version

print Net::DNS->version;

Returns the version of Net::DNS.

See the manual pages listed above for class-specific methods.

EXAMPLES

The following examples show how to use the DNS modules. Please note that most of the examples are simple and expect a successful query and certain record types. See the demo scripts included with the source code for examples of more robust code.

See the Net::DNS::Update manual page for an example of performing dynamic updates.

#
# Look up a host's addresses.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$query = $res->search("foo.bar.com");
foreach $record ($query->answer) {
    print $record->address, "\n";
}

#
# Find the nameservers for a domain.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$query = $res->query("foo.com", "NS");
foreach $nameserver ($query->answer) {
    print $nameserver->nsdname, "\n";
}

#
# Find the MX records for a domain.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$query = $res->query("foo.com", "MX");
foreach $mxhost ($query->answer) {
    print $mxhost->preference, " ", $mxhost->exchange, "\n";
}

#
# Print a domain's SOA record in zone file format.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$query = $res->query("foo.com", "SOA");
($query->answer)[0]->print;

#
# Perform a zone transfer and print all the records.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$res->nameservers("ns.foo.com");
@zone = $res->axfr("foo.com");
foreach $rr (@zone) {
    $rr->print;
}

#
# Send a background query and do some other processing while
# waiting for the answer.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$socket = $res->bgsend("foo.bar.com");
until ($res->bgisready($socket)) {
    # do some work here
    # ...and some more here
}
$packet = $res->bgread($socket);
$packet->print;

#
# Send a background query and use select() to determine when the answer
# has arrived.
#
use Net::DNS;
$res = new Net::DNS::Resolver;
$socket = $res->bgsend("foo.bar.com");
$rin = "";
vec($rin, $socket->fileno, 1) = 1;
# Add more descriptors to $rin if desired.
$timeout = 5;
$nfound = select($rout=$rin, undef, undef, $timeout);
if ($nfound < 1) {
    print "timed out after $timeout seconds\n";
}
elsif (vec($rout, $socket->fileno, 1) == 1) {
    $packet = $res->bgread($socket);
    $packet->print;
}
else {
    # Check for the other descriptors.
}

BUGS

Net::DNS is slow. Real slow.

For other items to be fixed, please see the TODO file included with the source distribution.

COPYRIGHT

Copyright (c) 1997 Michael Fuhr. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

perl(1), Net::DNS::Resolver, Net::DNS::Packet, Net::DNS::Update, Net::DNS::Header, Net::DNS::Question, Net::DNS::RR, RFC 1035