Robots-Validate is a Perl module that validates robots.txt files against a remote domain. The vulnerability in versions 0.3.2 through 0.3.10 allows the validation process to initiate an unbounded loop of outbound DNS queries. Each lookup is performed synchronously and continues until a PTR record resolves back to the client address, without any limit on the number or size of names queried. This can consume large amounts of network and system resources and leave the calling script blocked until all queries finish or time out.

Affected systems are installations that use any version of Robots-Validate from 0.3.2 up to, but not including, 0.3.11. This includes any Perl application that imports or otherwise relies on the Robots::Validate module within that version range.

With a CVSS score of 4.3, the vulnerability is considered moderate, but the lack of a bound to the DNS query list and the synchronous nature of the calls elevate the risk. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential for a local or authenticated attacker to control the PTR zone and thereby dictate an arbitrarily large list of DNS queries makes resource exhaustion a credible threat. Exploitation requires that the requester's User‑Agent string matches a rule that triggers the validation routine, and that the attacker can influence the reverse zone for their IP address, thereby selecting the size of the PTR response.