CVE-2026-82309

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82309

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82309.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82309

Aliases

GHSA-6399-5qhh-48h5

Published

2026-09-04T12:21:11.513Z

Modified

2026-09-06T03:47:07.702064990Z

Summary

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries

Details

Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries.

checkdns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either.

Any client whose User-Agent matches a rule with a domain reaches checkdns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out.

Database specific

{
    "cwe_ids": [
        "CWE-405",
        "CWE-770"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82309.json"
}

References

Affected packages

Git / github.com/robrwo/robots-validate

Affected ranges

Type

GIT

Repo

https://github.com/robrwo/robots-validate

Events

Introduced

6798c3eb2f7edc7695e67bf760144617aa5c61cf

Fixed

213adec224c387fc68646742876ce59b6ec9ca31

Fixed

6426178c49ff6c440922f31a92a6feb3c661b143

Database specific

Show details

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.3.2"
        },
        {
            "fixed": "0.3.11"
        }
    ]
}

Affected versions

v0.*

v0.3.10

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82309.json"