CVE-2026-64193
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability in the Net::DNS library for Perl (versions up to 1.55) allows remote code execution via a crafted EDNS EXTENDED ERROR record. The _decompose function improperly handles backtick characters (`), enabling system command injection.
Risk Assessment
An attacker can remotely execute arbitrary commands on the server if the application processes DNS responses with the EXTENDED-ERROR field in array context. This could lead to full system compromise, data theft, or lateral movement within the network.
Recommendation
Immediately update the Net::DNS library to version 1.56 or later, which includes the fix. If updating is not possible, avoid calling $pkt->edns->option('EXTENDED-ERROR') in array context.
Original NVD description (English source)
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.