NLNETLABS Net::DNS versions 0 through 1.55 are susceptible to a stack exhaustion vulnerability that can result in a service outage for applications parsing malicious DNS data.

This vulnerability involves uncontrolled recursion in the Net::DNS::DomainName::decode function, which fails to enforce a depth limit when following RFC 1035 compression pointers. The attack vector is network based and requires no authentication, allowing an attacker to trigger a stack overflow by sending a specially crafted DNS packet to the application.

The flaw carries a CVSS score of 7.5, reflecting its high potential for service disruption. Successful exploitation leads to a crash of the affected application or service, causing downtime that impacts availability for end users. Organizations relying on this library to parse DNS traffic are at risk of localized service outages if they process untrusted or malicious DNS responses.

Immediate Action: Upgrade the Net::DNS library to version 1.56 or later immediately to implement the required recursion depth limits.

Proactive Monitoring: Monitor application logs for unexpected service restarts or stack trace errors that may indicate attempts to trigger a crash via malformed DNS packets.

Compensating Controls: Deploy network traffic inspection tools or firewalls capable of identifying and dropping malformed DNS packets containing excessively deep compression chains.

Public Exploit Available: No

Given the ease of exploitability and the potential for service disruption, administrators should prioritize updating to version 1.56. Implementing this patch is the only definitive way to secure the application against stack exhaustion attacks targeting this library.