Vulnerability-Lookup

CVE-2026-64194 (GCVE-0-2026-64194)

Vulnerability from cvelistv5 – Published: 2026-07-20 17:55 – Updated: 2026-08-30 20:06

Title

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains

Summary

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet->new(\$wire)` i.e. any point where the library decodes a DNS message from the network.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 18:55 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 62/100 over 369 records in the last 180 days details

References

5 references

URL	Tags
https://www.net-dns.org/blog/#release-candidate-f…
https://rt.cpan.org/Ticket/Display.html?id=179946	issue-tracking
https://metacpan.org/release/NLNETLABS/Net-DNS-1.…	release-notes
http://www.openwall.com/lists/oss-security/2026/0…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version	CPE status
NLNETLABS	Net::DNS	Affected: 0 , ≤ 1.55 (custom)	guessed

Credits

Steffen Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-30T20:06:49.756Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-64194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T18:55:36.580996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T18:56:01.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Net-DNS",
          "product": "Net::DNS",
          "programFiles": [
            "lib/Net/DNS/DomainName.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::DNS::DomainName::decode"
            }
          ],
          "repo": "https://www.net-dns.org/svn/net-dns/",
          "vendor": "NLNETLABS",
          "versions": [
            {
              "lessThanOrEqual": "1.55",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Steffen Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T17:55:05.169Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 1.56 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-10T00:00:00.000Z",
          "value": "Issue reported publicly via RT."
        },
        {
          "lang": "en",
          "time": "2026-07-10T00:00:00.000Z",
          "value": "Version 1.55_01 (release candidate for version 1.56) published on CPAN."
        },
        {
          "lang": "en",
          "time": "2026-07-18T00:00:00.000Z",
          "value": "Version 1.56 published on CPAN."
        }
      ],
      "title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-64194",
    "datePublished": "2026-07-20T17:55:05.169Z",
    "dateReserved": "2026-07-19T10:13:00.756Z",
    "dateUpdated": "2026-08-30T20:06:49.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64194",
      "date": "2026-11-04",
      "epss": "0.0068",
      "percentile": "0.5249"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "packageName": "Net-DNS",
                "product": "Net::DNS",
                "programFiles": [
                  "lib/Net/DNS/DomainName.pm"
                ],
                "programRoutines": [
                  {
                    "name": "Net::DNS::DomainName::decode"
                  }
                ],
                "repo": "https://www.net-dns.org/svn/net-dns/",
                "vendor": "NLNETLABS",
                "versions": [
                  {
                    "lessThanOrEqual": "1.55",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network."
          },
          {
            "lang": "es",
            "value": "Las versiones de Net::DNS hasta la 1.55 para Perl permiten la denegaci\u00f3n de servicio a trav\u00e9s de cadenas profundas de punteros de compresi\u00f3n DNS.\n\nNet::DNS::DomainName::decode sigue los punteros de compresi\u00f3n de RFC 1035 recursando en s\u00ed mismo sin l\u00edmite de profundidad. Es posible construir un nombre que sature la pila de llamadas (al menos con respuestas TCP m\u00e1s grandes), lo que lleva a una potencial denegaci\u00f3n de servicio.\n\nLa protecci\u00f3n \u201c$link \u003c $offset\u201d previene cadenas hacia adelante y circulares, pero a\u00fan permite cadenas hacia atr\u00e1s arbitrariamente largas. La cach\u00e9 por desplazamiento (\u201c$cache\u201d) se rellena al inicio de cada llamada y solo evita la repetici\u00f3n de recorridos del mismo desplazamiento; el descenso inicial a trav\u00e9s de una cadena nueva a\u00fan recurre a profundidad completa.\n\nUn paquete manipulado puede encadenar punteros de compresi\u00f3n de dos bytes de modo que cada uno apunta dos bytes antes que el anterior, produciendo una longitud de cadena de \u201coffset / 2\u201d. Para el campo de puntero de 14 bits (desplazamiento m\u00e1ximo 16383), esto da hasta ~8191 marcos recursivos. Para un mensaje DNS TCP, el l\u00edmite es el campo de longitud de 16 bits (~32767 marcos). La pila C predeterminada de Perl maneja solo unos pocos miles de marcos; m\u00e1s all\u00e1 de eso, el proceso recibe SIGSEGV o similar, lo cual es una denegaci\u00f3n de servicio para cualquier aplicaci\u00f3n que analice datos DNS no confiables.\n\nLa vulnerabilidad se activa por \u201cNet::DNS::Packet  -\u003e  new(\\$wire)\u201d, es decir, cualquier punto donde la biblioteca decodifica un mensaje DNS de la red."
          }
        ],
        "id": "CVE-2026-64194",
        "lastModified": "2026-10-24T20:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-64194",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T18:55:36.580996Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-20T19:17:30.157",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-06T11:10:01+00:00",
      "cve": "CVE-2026-64194",
      "id": "CVE-2026-64194",
      "initial_release_date": "2026-07-20T17:55:05.169000+00:00",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Net::DNS: Net::DNS: Denial of Service via crafted DNS compression pointers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64194.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-08-30T20:06:49.756Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-64194",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-21T18:55:36.580996Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-21T18:55:57.115Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://cpan.org/modules",
              "defaultStatus": "unaffected",
              "packageName": "Net-DNS",
              "product": "Net::DNS",
              "programFiles": [
                "lib/Net/DNS/DomainName.pm"
              ],
              "programRoutines": [
                {
                  "name": "Net::DNS::DomainName::decode"
                }
              ],
              "repo": "https://www.net-dns.org/svn/net-dns/",
              "vendor": "NLNETLABS",
              "versions": [
                {
                  "lessThanOrEqual": "1.55",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "Steffen Ullrich"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-674",
                  "description": "CWE-674 Uncontrolled Recursion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-20T17:55:05.169Z",
            "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "shortName": "CPANSec"
          },
          "references": [
            {
              "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
            },
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 1.56 or later."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2026-07-10T00:00:00.000Z",
              "value": "Issue reported publicly via RT."
            },
            {
              "lang": "en",
              "time": "2026-07-10T00:00:00.000Z",
              "value": "Version 1.55_01 (release candidate for version 1.56) published on CPAN."
            },
            {
              "lang": "en",
              "time": "2026-07-18T00:00:00.000Z",
              "value": "Version 1.56 published on CPAN."
            }
          ],
          "title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains",
          "x_generator": {
            "engine": "cpansec-cna-tool 0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "assignerShortName": "CPANSec",
        "cveId": "CVE-2026-64194",
        "datePublished": "2026-07-20T17:55:05.169Z",
        "dateReserved": "2026-07-19T10:13:00.756Z",
        "dateUpdated": "2026-08-30T20:06:49.756Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-FPDNS-CVE-2026-64194 (CVE-2026-64194)

Vulnerability from osv_homebrew – Published: 2026-08-13 09:27 – Updated: 2026-08-13 09:27 – Source website

Summary

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

Details

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.

The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.

A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.

The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.

References

URL

Type

	https://metacpan.org/release/NLNETLABS/Net-DNS-1.…	WEB
	https://rt.cpan.org/Ticket/Display.html?id=179946	WEB
	https://www.net-dns.org/blog/#release-candidate-f…	WEB
	http://www.openwall.com/lists/oss-security/2026/0…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "Net::DNS",
        "resource_purl": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
        "upstream_fixed_in": "1.56"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "fpdns",
        "purl": "pkg:brew/fpdns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "medium",
    "source": "matched",
    "strategy": "cpansa",
    "upstream_evidence": [
      {
        "ecosystem": "CPAN",
        "key": "pkg:cpan/NLNETLABS/Net-DNS@1.24",
        "name": "Net-DNS",
        "resource": "Net::DNS",
        "strategy": "cpansa",
        "subject_version": "1.24"
      }
    ]
  },
  "details": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.",
  "id": "BREW-fpdns-CVE-2026-64194",
  "modified": "2026-08-13T09:27:16Z",
  "published": "2026-08-13T09:27:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
    },
    {
      "type": "WEB",
      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
    },
    {
      "type": "WEB",
      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
    }
  ],
  "schema_version": "1.7.3",
  "summary": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.",
  "upstream": [
    "CVE-2026-64194"
  ]
}

FKIE_CVE-2026-64194

Vulnerability from fkie_nvd - Published: 2026-07-20 19:17 - Updated: 2026-10-24 20:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://rt.cpan.org/Ticket/Display.html?id=179946
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/07/20/13
	af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "Net-DNS",
          "product": "Net::DNS",
          "programFiles": [
            "lib/Net/DNS/DomainName.pm"
          ],
          "programRoutines": [
            {
              "name": "Net::DNS::DomainName::decode"
            }
          ],
          "repo": "https://www.net-dns.org/svn/net-dns/",
          "vendor": "NLNETLABS",
          "versions": [
            {
              "lessThanOrEqual": "1.55",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network."
    },
    {
      "lang": "es",
      "value": "Las versiones de Net::DNS hasta la 1.55 para Perl permiten la denegaci\u00f3n de servicio a trav\u00e9s de cadenas profundas de punteros de compresi\u00f3n DNS.\n\nNet::DNS::DomainName::decode sigue los punteros de compresi\u00f3n de RFC 1035 recursando en s\u00ed mismo sin l\u00edmite de profundidad. Es posible construir un nombre que sature la pila de llamadas (al menos con respuestas TCP m\u00e1s grandes), lo que lleva a una potencial denegaci\u00f3n de servicio.\n\nLa protecci\u00f3n \u201c$link \u003c $offset\u201d previene cadenas hacia adelante y circulares, pero a\u00fan permite cadenas hacia atr\u00e1s arbitrariamente largas. La cach\u00e9 por desplazamiento (\u201c$cache\u201d) se rellena al inicio de cada llamada y solo evita la repetici\u00f3n de recorridos del mismo desplazamiento; el descenso inicial a trav\u00e9s de una cadena nueva a\u00fan recurre a profundidad completa.\n\nUn paquete manipulado puede encadenar punteros de compresi\u00f3n de dos bytes de modo que cada uno apunta dos bytes antes que el anterior, produciendo una longitud de cadena de \u201coffset / 2\u201d. Para el campo de puntero de 14 bits (desplazamiento m\u00e1ximo 16383), esto da hasta ~8191 marcos recursivos. Para un mensaje DNS TCP, el l\u00edmite es el campo de longitud de 16 bits (~32767 marcos). La pila C predeterminada de Perl maneja solo unos pocos miles de marcos; m\u00e1s all\u00e1 de eso, el proceso recibe SIGSEGV o similar, lo cual es una denegaci\u00f3n de servicio para cualquier aplicaci\u00f3n que analice datos DNS no confiables.\n\nLa vulnerabilidad se activa por \u201cNet::DNS::Packet  -\u003e  new(\\$wire)\u201d, es decir, cualquier punto donde la biblioteca decodifica un mensaje DNS de la red."
    }
  ],
  "id": "CVE-2026-64194",
  "lastModified": "2026-10-24T20:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64194",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T18:55:36.580996Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T19:17:30.157",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    }
  ]
}

GHSA-M3GJ-74X3-VC94

Vulnerability from github – Published: 2026-07-20 21:31 – Updated: 2026-08-30 21:30

Details

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-20T19:17:30Z",
    "severity": "HIGH"
  },
  "details": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.\n\nNet::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.\n\nThe guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.\n\nA crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.\n\nThe vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.",
  "id": "GHSA-m3gj-74x3-vc94",
  "modified": "2026-08-30T21:30:25Z",
  "published": "2026-07-20T21:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64194"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00052.html"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes"
    },
    {
      "type": "WEB",
      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
    },
    {
      "type": "WEB",
      "url": "https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/20/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:11396-1

Vulnerability from csaf_opensuse - Published: 2026-07-28 00:00 - Updated: 2026-09-17 17:17

Summary

perl-Net-DNS-1.560.0-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2026-64194.

CVE-2026-64194

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2026:21437-1

Vulnerability from csaf_opensuse - Published: 2026-07-22 20:52 - Updated: 2026-09-17 17:40

Summary

Security update for perl-Net-DNS

Severity

Critical

Scope

2 vulnerabilities in this advisory, including CVE-2026-64194.

CVE-2026-64194

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 1 product

Open the full advisory

OPENSUSE-SU-2026:21859-1

Vulnerability from csaf_opensuse - Published: 2026-09-15 13:20 - Updated: 2026-09-17 17:44

Summary

Security update for perl-Net-DNS

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2026-64194.

CVE-2026-64194

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 1 product

Open the full advisory

SUSE-SU-2026:3431-1

Vulnerability from csaf_suse - Published: 2026-07-30 18:50 - Updated: 2026-09-17 16:37

Summary

Security update for perl-Net-DNS

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2026-64194.

CVE-2026-64194

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 17 products

Open the full advisory

UBUNTU-CVE-2026-64194 (CVE-2026-64194)

Vulnerability from osv_ubuntu – Published: 2026-07-20 19:17 – Updated: 2026-10-17 09:47 – Source website

Details

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-64194	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-64194	REPORT
	https://lists.security.metacpan.org/cve-announce/…	REPORT
	https://rt.cpan.org/Ticket/Display.html?id=179946	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "0.68-1.2build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@0.68-1.2build1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.68-1.2",
        "0.68-1.2build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "0.81-2build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@0.81-2build1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.81-2",
        "0.81-2build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.10-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.10-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.22-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.22-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.20-1",
        "1.21-1",
        "1.22-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.33-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.33-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.29-1",
        "1.32-1",
        "1.33-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.44-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.44-1ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.39-2ubuntu1",
        "1.40-1ubuntu1",
        "1.44-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.55-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.55-1ubuntu1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.54-1ubuntu1",
        "1.55-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libnet-dns-perl",
            "binary_version": "1.54-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libnet-dns-perl",
        "purl": "pkg:deb/ubuntu/libnet-dns-perl@1.54-1ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.50-1ubuntu1",
        "1.53-1ubuntu1",
        "1.54-1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link \u003c $offset` prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache (`$cache`) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth. A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of `offset / 2`. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl\u0027s default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data. The vulnerability is triggered by `Net::DNS::Packet-\u003enew(\\$wire)` i.e. any point where the library decodes a DNS message from the network.",
  "id": "UBUNTU-CVE-2026-64194",
  "modified": "2026-10-17T09:47:15Z",
  "published": "2026-07-20T19:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-64194"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64194"
    },
    {
      "type": "REPORT",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/41989541/"
    },
    {
      "type": "REPORT",
      "url": "https://rt.cpan.org/Ticket/Display.html?id=179946"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-64194"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-64194 (GCVE-0-2026-64194)

BREW-FPDNS-CVE-2026-64194 (CVE-2026-64194)

FKIE_CVE-2026-64194

GHSA-M3GJ-74X3-VC94

OPENSUSE-SU-2026:11396-1

OPENSUSE-SU-2026:21437-1

OPENSUSE-SU-2026:21859-1

SUSE-SU-2026:3431-1

UBUNTU-CVE-2026-64194 (CVE-2026-64194)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour