CVE-2026-64193: Net::DNS eval injection in EDNS EXTENDED ERROR

Executive brief

Net::DNS is a widely used Perl library for performing DNS lookups and managing DNS packets. A security flaw in how the library handles specific error messages (EDNS Extended Errors) allows an attacker to execute malicious commands on the system running the software. This could lead to a full system compromise, data theft, or service disruption.

Technical details

The vulnerability exists in the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function. When parsing the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914), the library tokenizes raw bytes and passes them to Perl's eval() function. While the code attempts to escape ' and '@' characters, it fails to escape backticks (`). An attacker can exploit this by sending a specially crafted DNS packet containing a payload such as {0:`"<command>"`} in the EXTRA-TEXT field. If the application calls $pkt->edns->option('EXTENDED-ERROR') in an array context, the injected command is executed. This issue is addressed in version 1.56.

Affected products

• NLnet Labs Net::DNS through 1.55

Timeline

• 2026-07-11: other: Release candidate 1.55_01 made available
• 2026-07-18: patched: Version 1.56 released fixing the injection issue
• 2026-07-20: disclosed: CVE-2026-64193 published

References

• https://cpan.org/modules
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
• https://rt.cpan.org/Ticket/Display.html?id=179945
• https://www.net-dns.org/blog/