CVE-2026-64193 in Perl
Summary
by MITRE • 07/20/2026
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in Net::DNS versions through 1.55 represents a critical remote code execution flaw that arises from improper input validation within the EDNS EXTENDED-ERROR option parsing mechanism. This issue specifically affects the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose method which processes the EXTRA-TEXT field of RFC 8914 compliant extended error options. The vulnerability stems from the method's reliance on Perl's eval function to process tokenized data without adequate sanitization, creating a dangerous attack surface that can be exploited by remote adversaries. The flaw exists because the parsing logic implements partial escaping mechanisms that handle dollar signs and at symbols but fails to escape backticks, which in Perl syntax trigger command execution.
The technical exploitation occurs when the affected method processes an EXTENDED-ERROR option containing malicious input within the EXTRA-TEXT field. Specifically, a payload formatted as {0:`""`} can be crafted to bypass the existing escaping mechanisms while still triggering command execution through the eval function. When this malformed data passes through the tokenization process and subsequently into Perl's eval statement, any backtick expressions contained within the input are interpreted as shell commands rather than literal text. This creates a classic command injection vulnerability that allows attackers to execute arbitrary system commands with the privileges of the process running the Net::DNS library. The vulnerability is particularly dangerous because it can be triggered simply by calling $pkt->edns->option('EXTENDED-ERROR') in array context, making it accessible through normal network packet processing operations.
The operational impact of this vulnerability extends across numerous network infrastructure components that rely on Net::DNS for DNS resolution and packet processing. Systems utilizing this library for DNS server functionality, DNS proxy services, or any application that processes DNS responses containing extended error options become vulnerable to remote code execution attacks. Attackers can leverage this vulnerability to execute arbitrary commands on affected systems, potentially leading to full system compromise, data exfiltration, or lateral movement within network environments. The vulnerability affects both IPv4 and IPv6 DNS traffic processing and can be exploited through various attack vectors including malicious DNS responses, DNS tunneling, or man-in-the-middle scenarios where attackers can inject malformed extended error options into legitimate DNS communications.
This vulnerability maps directly to CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.003 for command and scripting interpreter execution. The attack surface is particularly concerning given that Net::DNS is a widely used Perl library in network security applications, DNS servers, and monitoring tools. Organizations using affected versions should immediately implement mitigations including upgrading to patched versions of the library, implementing network segmentation to limit DNS traffic exposure, and deploying intrusion detection systems capable of identifying malformed DNS extended error options. Additionally, network administrators should consider implementing DNS response validation mechanisms and monitoring for unusual command execution patterns that might indicate exploitation attempts. The vulnerability demonstrates the critical importance of proper input sanitization in interpreted languages where dynamic code execution capabilities exist within core parsing functions.
The root cause analysis reveals that this vulnerability represents a failure to properly apply security principles during library development, specifically around the handling of untrusted data passed to dynamically evaluated code constructs. The partial escaping implementation suggests either inadequate threat modeling or insufficient understanding of Perl's command execution semantics. This flaw highlights the necessity for comprehensive security testing of network protocol parsing libraries and demonstrates how seemingly minor implementation oversights can result in critical security vulnerabilities. Organizations should conduct thorough audits of their dependency management systems to identify all instances of vulnerable Net::DNS versions and ensure proper patching across their infrastructure.