Net::DNS versions before 1.57 for Perl contain an unbounded recursion in the sig_data function when a message with a misplaced TSIG record is re‑encoded. The recursion is triggered only when the TSIG carries an empty MAC, causing the function to call itself indefinitely with no termination condition. Each recursive round re‑encodes the entire packet, so even a payload of fewer than 100 bytes can exhaust the host’s available memory and ultimately terminate the process, resulting in a denial‑of‑service. The vulnerability is a classic reliability weakness identified as CWE‑674 and CWE‑835.

The affected product is the Net::DNS Perl module, version 1.56 and earlier. Systems that use this library in DNS forwarder or proxy roles—such as local DHCP servers, DNS forwarding services, or any application that forwards arbitrary DNS messages—are vulnerable if they re‑encode messages they have previously decoded. Applications that merely decode DNS packets without re‑encoding them, or environments that do not use the Net::DNS module, are not impacted.

The CVSS score is 7.5, and the EPSS score is less than 1%. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can trigger the recursion by sending a crafted DNS message with a misplaced TSIG record and an empty MAC to a vulnerable component that re‑encodes the packet. The likely attack vector is an external DNS request, so remote exploitation is possible. Because the flaw requires only a small packet and a simple re‑encoding operation, the impact can be immediate and the attack can be automated, yet the low EPSS score indicates that the probability of fresh exploitation is presently uncertain.