CVE-2026-64193: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64193 is an eval injection (CWE-95) vulnerability in Net::DNS for Perl that allows remote code execution via a maliciously crafted EDNS EXTENDED-ERROR option. All versions of Net::DNS through 1.55 are affected. The vulnerability was published on July 20, 2026, and a patch is available. The CVSS base score has not yet been formally assigned, though the severity is assessed as High (GitHub Advisory, ENISA EUVD).

The root cause is an improper neutralization of directives in dynamically evaluated code (CWE-95) within the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function. This function parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (as defined in RFC 8914) by tokenizing raw bytes and passing the result directly to Perl's eval built-in. While the code escapes $ and @ characters to prevent variable interpolation, it does not escape backticks, which Perl uses for shell command execution. An attacker can exploit this by embedding a payload such as {0:\"<command>"`}in the EXTRA-TEXT field of a DNS response; exploitation requires that the receiving application calls$pkt->edns->option('EXTENDED-ERROR')` in array context (GitHub Advisory, oss-security).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands on the host running the vulnerable Perl application. The attacker's commands run with the privileges of the process using Net::DNS, potentially enabling full system compromise, data exfiltration, installation of malware, or lateral movement within the network. Any application that processes DNS responses containing EDNS EXTENDED-ERROR options and calls the affected method in array context is at risk (GitHub Advisory, ENISA EUVD).

1. Reconnaissance: Identify target applications that use Net::DNS (versions ≤ 1.55) for Perl and process DNS responses, particularly those that call $pkt->edns->option('EXTENDED-ERROR') in array context.
2. Position for DNS response manipulation: Set up a malicious DNS server or perform a DNS spoofing/man-in-the-middle attack to deliver a crafted DNS response to the target application.
3. Craft malicious DNS packet: Construct a DNS response packet containing an EDNS EXTENDED-ERROR option (RFC 8914) with a malicious EXTRA-TEXT field embedding a backtick payload, e.g., {0:\"<command>"`}where<command>` is the OS command to execute.
4. Deliver the packet: Cause the target application to receive and process the crafted DNS response, triggering the _decompose function to tokenize the EXTRA-TEXT field.
5. Achieve code execution: The unescaped backtick payload is passed to Perl's eval, causing the embedded shell command to execute with the privileges of the running process (GitHub Advisory, oss-security).

• Network: Unexpected or anomalous DNS responses containing EDNS EXTENDED-ERROR options (RFC 8914) from untrusted or external DNS servers; DNS responses with unusual or binary-looking EXTRA-TEXT fields containing backtick characters.
• Process: Unexpected child processes spawned by Perl interpreter processes (e.g., /bin/sh, bash, curl, wget, nc) that are associated with DNS-processing applications.
• Logs: Application logs showing errors or unexpected output from Net::DNS EDNS option parsing; system logs recording unusual command execution originating from Perl-based services.
• File System: New or modified files (scripts, binaries, cron jobs) created by the user account running the Net::DNS-based application following DNS query activity.

Upgrade Net::DNS to a version newer than 1.55 (release candidate 1.55_01 and the forthcoming 1.56 release address this issue by properly escaping backticks and other special characters in the EDNS EXTENDED-ERROR EXTRA-TEXT field). As an interim workaround, review application code to avoid calling $pkt->edns->option('EXTENDED-ERROR') in array context, and restrict DNS query responses to trusted resolvers only. The patch details and release candidate are available via the Net::DNS project blog and MetaCPAN (GitHub Advisory, Net::DNS Blog, MetaCPAN).

The vulnerability was disclosed via the oss-security mailing list on July 20, 2026, and noted on Bluesky by the infosec community shortly after (oss-security, Bluesky). No major vendor statements or extensive media coverage have been observed at this time.