A vulnerability in the Net::DNS Perl library allows unauthenticated remote attackers to trigger memory exhaustion and service failure via specially crafted DNS traffic.

The flaw is an uncontrolled recursion (CWE-674) within the sig_data function that occurs when re-encoding messages containing misplaced TSIG records. Because the library fails to terminate the recursion when an improperly placed TSIG is encountered, an unauthenticated attacker can force the application to consume all available memory.

The exploitation of this vulnerability results in a denial of service for any application utilizing the affected library to forward or proxy DNS messages. Given the CVSS score of 7.5, this high-severity issue poses a significant risk to infrastructure stability, as the attack is easily automatable and requires no authentication. Organizations relying on Net::DNS for critical network routing or resolution services may experience total service outages if targeted.

Immediate Action: Update the Net::DNS Perl package to version 1.57 or later to incorporate the termination conditions for the sig_data recursion.

Proactive Monitoring: Monitor system memory usage and DNS service logs for abnormal patterns, particularly high memory consumption or repeated warnings related to TSIG processing.

Compensating Controls: If immediate patching is not feasible, implement network-level filtering to reject malformed DNS packets that violate RFC 8945, or configure ingress firewalls to limit the frequency of DNS traffic directed at vulnerable proxy services.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the availability of network services utilizing the Net::DNS library. Administrators should prioritize the update to version 1.57 across all affected Perl environments immediately. Failure to patch may leave systems susceptible to trivial denial-of-service attacks that could disrupt core business operations.