CVE-2026-64193

Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.56

Description Remote execution injection is possible via EDNS EXTENDED ERROR. The function decompose() in Net::DNS::RR::OPT::EXTENDED ERROR parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option by tokenizing raw bytes and passing the result to Perl's eval. While escaping is implemented for $ and @, backticks are not escaped. This allows command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, specifically when a payload containing backticks is provided in the EXTRA-TEXT field.

Recommendations Update Net::DNS to a version newer than 1.55.