CVE-2026-64193
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability in the Net::DNS library for Perl (versions up to 1.55) allows remote code execution via a crafted EDNS EXTENDED ERROR record. The _decompose function improperly handles backtick characters (`), enabling system command injection.
Risk Assessment
An attacker can remotely execute arbitrary commands on the server if the application processes DNS responses with the EXTENDED-ERROR field in array context. This could lead to full system compromise, data theft, or lateral movement within the network.
Recommendation
Immediately update the Net::DNS library to version 1.56 or later, which includes the fix. If updating is not possible, avoid calling $pkt->edns->option('EXTENDED-ERROR') in array context.
Other vulnerabilities in Net::DNS
See all- CVE-2026-81928High
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. The recursion is reached only when the decoded TSIG carries an empty MAC and only from code that re-encodes a decoded message, such as a forwarder or a proxy. Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.
- CVE-2026-64194High
Vulnerability in Net::DNS for Perl up to version 1.55. Allows DoS via deep DNS compression pointer chains. The decode function recursively processes pointers without depth limit, potentially overflowing the stack and causing SIGSEGV.
Original NVD description (English source)
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.