Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1127 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-81928:
    Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when     re-encoding a message with a misplaced TSIG record.

    sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A     TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-     enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not     the last record on the wire raises misplaced or corrupt TSIG, but the error is caught, reported as a     warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.

    The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the     wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded,     such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message     direction does not matter: a query reaches the same path as a response.

    Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and     terminate the process.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_68786 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-2026_68787 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-57f107ed83 advisory.

    Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced     TSIG records)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-48a4531e02 advisory.

    Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced     TSIG records)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1884:01 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1885:02 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:68786 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4065-1 advisory.

    This update for perl-Net-DNS fixes the following issue:

    - CVE-2026-81928: memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a     misplaced TSIG       record (bsc#1278084).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4086-1 advisory.

    This update for perl-Net-DNS fixes the following issue:

    - CVE-2026-81928: memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a     misplaced TSIG       record (bsc#1278084).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:68786 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:68787 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-68786 advisory.

    - Fix CVE-2026-81928: Unbounded recursion when re-encoding message with       misplaced TSIG

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-68787 advisory.

    - Fix unbounded recursion in TSIG record processing (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:68787 advisory.

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68786 advisory.

    The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS)     resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the     gethostbyname and gethostbyaddr routines.

    Security Fix(es):

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:68787 advisory.

    The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS)     resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the     gethostbyname and gethostbyaddr routines.

    Security Fix(es):

    * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records     (CVE-2026-81928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21859-1 advisory.

    Changes in perl-Net-DNS:

    Updated to 1.570.0 (1.57):

    See /usr/share/doc/packages/perl-Net-DNS/Changes .

      -     Resync with IANA DNS parameters registry.
      -     EDNS: Add support for MQTYPE-QUERY option.
      -     Unbounded recursion when re-encoding message with misplaced TSIG CVE-2026-81928 bsc#1278084
      -     UNIX resolver can fail in taint mode

      -     Documentation issue for Net::DNS::RR::RRSIG::verify()
      -     Denial of Service via long DNS compression chains CVE-2026-64194 bsc#1272214
      -     Remote code injection via EDNS EXTENDED ERROR CVE-2026-64193 bsc#1272212
      -     UNIX.pm: Unreachable code warning using Apache/mod_perl

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when     re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and     removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section     survives that step and is signed again, so encoding re-enters sig_data with no termination condition.
    Decoding does not reject such a message: a TSIG that is not the last record on the wire raises misplaced     or corrupt TSIG, but the error is caught, reported as a warning, and the record is left in the packet.
    RFC 8945 section 5.2 requires the message to be dropped. The recursion is reached only when the decoded     TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is     reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded     message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the     same path as a response. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire     exhaust available memory and terminate the process. (CVE-2026-81928)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365140	TencentOS Server 3: perl-Net-DNS (TSSA-2026:1127)	Nessus	Tencent Local Security Checks	Local	high
356694	Rocky Linux 9 [CIQ] Security Update: perl-Net-DNS / perl-Net-DNS-Nameserver (crlsa-2026_68786)	Nessus	Rocky Linux Local Security Checks	Local	high
354671	Rocky Linux 8 [CIQ] Security Update: perl-Net-DNS (crlsa-2026_68787)	Nessus	Rocky Linux Local Security Checks	Local	high
349131	Fedora 44 : perl-Net-DNS (2026-57f107ed83)	Nessus	Fedora Local Security Checks	Local	high
349118	Fedora 43 : perl-Net-DNS (2026-48a4531e02)	Nessus	Fedora Local Security Checks	Local	high
348664	MiracleLinux 9 : perl-Net-DNS-1.29-6.el9_8.1 (AXSA:2026-1884:01)	Nessus	Miracle Linux Local Security Checks	Local	high
348661	MiracleLinux 8 : perl-Net-DNS-1.15-2.el8_10 (AXSA:2026-1885:02)	Nessus	Miracle Linux Local Security Checks	Local	high
348578	RockyLinux 9 : perl-Net-DNS (RLSA-2026:68786)	Nessus	Rocky Linux Local Security Checks	Local	high
348451	SUSE SLES12 Security Update : perl-Net-DNS (SUSE-SU-2026:4065-1)	Nessus	SuSE Local Security Checks	Local	high
348406	SUSE SLED15 / SLES15 Security Update : perl-Net-DNS (SUSE-SU-2026:4086-1)	Nessus	SuSE Local Security Checks	Local	high
348292	AlmaLinux 9 : perl-Net-DNS (ALSA-2026:68786)	Nessus	Alma Linux Local Security Checks	Local	high
348287	RockyLinux 8 : perl-Net-DNS (RLSA-2026:68787)	Nessus	Rocky Linux Local Security Checks	Local	high
348158	Oracle Linux 9 : perl-Net-DNS (ELSA-2026-68786)	Nessus	Oracle Linux Local Security Checks	Local	high
348156	Oracle Linux 8 : perl-Net-DNS (ELSA-2026-68787)	Nessus	Oracle Linux Local Security Checks	Local	high
347975	AlmaLinux 8 : perl-Net-DNS (ALSA-2026:68787)	Nessus	Alma Linux Local Security Checks	Local	high
347947	RHEL 9 : perl-Net-DNS (RHSA-2026:68786)	Nessus	Red Hat Local Security Checks	Local	high
347946	RHEL 8 : perl-Net-DNS (RHSA-2026:68787)	Nessus	Red Hat Local Security Checks	Local	high
347913	openSUSE 16 Security Update : perl-Net-DNS (openSUSE-SU-2026:21859-1)	Nessus	SuSE Local Security Checks	Local	critical
342299	Linux Distros Unpatched Vulnerability : CVE-2026-81928	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-81928

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high