CVE-2026-64193 NLNETLABS CVE debrief

Who should care

System administrators and developers using Net::DNS versions up to 1.55 for Perl, especially those exposed to untrusted input, should assess their exposure and prioritize updating to version 1.56 or later.

Why it matters

CVE-2026-64193 is a critical vulnerability in Net::DNS for Perl, allowing remote execution injection via EDNS EXTENDED ERROR. System administrators and developers should assess their exposure, prioritize updating to version 1.56 or later, and verify input validation.

• Remote code execution is possible if $pkt->edns->option('EXTENDED-ERROR') is called in array context
• Command execution can be achieved with a crafted payload in the EXTRA-TEXT field
• Verification of Net::DNS version and input validation is necessary
• Remediation priority is high for systems using vulnerable Net::DNS versions

Technical summary

The Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function is vulnerable to remote execution injection via EDNS EXTENDED ERROR. The function tokenizes the raw bytes of the EXTRA-TEXT field and passes the result to Perl's eval, allowing for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context. System administrators and developers using Net::DNS versions up to 1.55 for Perl should assess their exposure and prioritize updating to version 1.56 or later. Verification of input validation is necessary to prevent command execution.

Defensive priority

High priority for systems using Net::DNS versions up to 1.55 for Perl, especially those exposed to untrusted input.

Recommended defensive actions

• Update Net::DNS to version 1.56 or later
• Restrict input to $pkt->edns->option('EXTENDED-ERROR')
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability in Net::DNS versions up to 1.55 for Perl is confirmed. Official information is provided in the CVE record and NVD detail page. Defenders should verify input validation and assess exposure to untrusted input. The EXTRA-TEXT field of an EDNS EXTENDED-ERROR option can be exploited for command execution. Verification of Net::DNS version and input validation is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.