CVE-2026-64193: Net::DNS Perl RCE Vulnerability

CVE-2026-64193 Overview

CVE-2026-64193 is a remote code execution vulnerability in the Net::DNS Perl module versions through 1.55. The flaw resides in Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose, which parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914). The function tokenises raw bytes and passes the result to Perl's eval. Escaping is applied to $ and @ characters but not to backticks, enabling command execution through backtick-wrapped payloads in EXTRA-TEXT. Any application invoking $pkt->edns->option('EXTENDED-ERROR') in array context is exposed to attacker-supplied DNS responses. The issue is classified under [CWE-95] Improper Neutralization of Directives in Dynamically Evaluated Code.

Critical Impact
A remote attacker controlling DNS responses can execute arbitrary shell commands on any Perl application that parses EDNS EXTENDED-ERROR options in array context.

Affected Products

Net::DNS for Perl versions through 1.55
Perl applications using Net::DNS::RR::OPT::EXTENDED_ERROR
DNS resolvers, mail servers, and monitoring tools built on Net::DNS

Discovery Timeline

2026-07-20 - CVE-2026-64193 published to NVD
2026-07-20 - Openwall OSS-Security advisory posted
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64193

Vulnerability Analysis

The vulnerability originates in the _decompose method of the Net::DNS::RR::OPT::EXTENDED_ERROR class. When the module parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option defined in RFC 8914, it tokenises raw response bytes and forwards them to Perl's eval function. The eval construct interprets the input as executable Perl code rather than data.

The developers applied escaping to the $ and @ sigils to block variable interpolation attacks. However, backtick characters were omitted from the escaping routine. In Perl, backticks execute the enclosed string as a shell command and return the output. An attacker who controls a DNS response can supply an EXTRA-TEXT payload such as {0: followed by backtick-wrapped shell commands, which the vulnerable code will pass to eval and execute.

Root Cause

The root cause is unsafe use of eval on attacker-controlled data combined with incomplete input sanitisation. The parser trusts remote DNS response content and treats it as Perl source code. Any code injection defence that enumerates dangerous characters instead of using a safe parser is fragile, and this bug demonstrates the pattern by missing backticks entirely.

Attack Vector

Exploitation requires the attacker to deliver a crafted DNS response containing an EDNS EXTENDED-ERROR option with a malicious EXTRA-TEXT payload. The victim application must call $pkt->edns->option('EXTENDED-ERROR') in array context. Any DNS resolver, mail server, or security tool relying on Net::DNS that queries attacker-influenced domains or accepts spoofed responses is exposed. The attack requires no authentication and no user interaction.

According to public technical references, the payload structure {0: followed by backtick-enclosed command strings triggers command execution during response parsing. See the RT Ticket #179945 and Openwall OSS Security discussion for the full disclosure.

Detection Methods for CVE-2026-64193

Indicators of Compromise

DNS responses containing EDNS EXTENDED-ERROR options with backtick characters in the EXTRA-TEXT field
Unexpected child processes spawned by Perl processes using Net::DNS (/bin/sh, perl, or shell utilities)
Outbound connections from Perl processes to previously unseen hosts following DNS query activity
Modifications to files or crontabs by user accounts running DNS-consuming Perl services

Detection Strategies

Inventory installed Perl modules and flag any Net::DNS version at or below 1.55 using cpan -D Net::DNS or equivalent package queries
Deploy DNS response inspection at the network edge to identify EXTENDED-ERROR options containing backtick bytes (0x60)
Correlate process ancestry logs to detect Perl interpreters launching shell processes without legitimate parent context
Review application source for edns->option('EXTENDED-ERROR') calls invoked in list or array context

Monitoring Recommendations

Enable command-line auditing on Linux hosts running Perl-based DNS tooling and forward events to a centralised log store
Alert on Perl processes making outbound socket connections outside of the DNS port range
Monitor CPAN mirrors and vendor package feeds for the Net::DNS 1.56 release advisory
Track DNS resolver telemetry for anomalous EXTENDED-ERROR option volume from external servers

How to Mitigate CVE-2026-64193

Immediate Actions Required

Upgrade Net::DNS to version 1.55_01 or later as soon as the release candidate is promoted to stable; consult the Net-DNS release notes
Audit all Perl code for calls to $pkt->edns->option('EXTENDED-ERROR') and avoid array context until patching completes
Restrict outbound DNS resolution to trusted resolvers that strip or normalise EDNS EXTENDED-ERROR options
Run Perl DNS services under least-privilege accounts with restrictive filesystem and network policies

Patch Information

The maintainers addressed the vulnerability in Net::DNS 1.55_01, with the stable 1.56 release identified as the fixed version. The changelog is published on MetaCPAN. Administrators should update through their operating system package manager or via cpan Net::DNS once vendor packages are refreshed.

Workarounds

Call $pkt->edns->option('EXTENDED-ERROR') only in scalar context, which does not invoke the vulnerable decode path
Filter DNS responses at a validating proxy to strip EDNS option code 15 (EXTENDED DNS Error) before delivery to Perl consumers
Apply mandatory access controls such as AppArmor or SELinux profiles to prevent Perl processes from executing shell binaries

bash

# Verify the installed Net::DNS version and upgrade
perl -MNet::DNS -e 'print $Net::DNS::VERSION, "\n"'
cpan -f install NLNETLABS/Net-DNS-1.55_01.tar.gz