CVE-2026-82309: Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries
Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries.
checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either.
Any client whose User-Agent matches a rule with a domain reaches checkdns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Robots::Validate (Perl)to a version that resolves this vulnerability.Fixed in 0.3.11
Event History
Frequently Asked Questions
Which requests can trigger the DNS query loop?
Any client whose User-Agent matches a rule with a domain reaches _check_dns. The affected validation path performs a PTR lookup for the client address and then forward lookups for returned names that match the rule's domain.
What control does an attacker need to cause excessive queries?
The attacker needs to control the reverse DNS zone for their own client IP address. They can place an unbounded number of matching names in the PTR response, causing a distinct forward DNS lookup for each name.
Does DNS response truncation limit the number of queries?
No. Net::DNS refetches truncated DNS answers over TCP by default, so the 512-byte UDP payload limit does not bound the number of PTR names processed.
What is the operational impact during exploitation?
Forward lookups are synchronous, so the caller remains blocked until every query completes or times out. Because the names are distinct and client-controlled, they miss the local cache and are resolved against the domain's authoritative DNS servers.