External risk intelligence

Net::DNS Perl Module Remote Code Execution via EDNS Extended Error.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64193

Net::DNS is a library used by various Perl applications to parse DNS data. While it can process data originating from the internet via DNS queries or responses, it is a backend library rather than an internet-facing service itself. Whether it is exposed depends entirely on the specific application implementation, making public reachability possible but not inherent to the library's deployment.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Net::DNS Perl library that could allow remote code execution. The issue arises from how the library processes specific DNS data, potentially enabling an attacker to inject and run malicious commands on a system if a vulnerable application makes a specially crafted DNS query. The primary concern is to confirm if any of our systems utilize this library in a way that exposes this vulnerability.

Remote code execution flaw in DNS processing.
Potential for attackers to run commands on systems.
Confirm relevance and exposure to your environment.

Attack Path

How an attacker could exploit the issue

A remote attacker could inject malicious commands by sending specially crafted DNS responses. The vulnerability lies in how the Net::DNS library processes extended error messages, specifically by using Perl's `eval` function on user-controlled input without sufficient sanitization. If an application using this library calls the vulnerable function in a specific context, an attacker could achieve remote code execution.

Requires network access.
Triggered by crafted DNS responses.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject and execute arbitrary commands on systems running affected Perl applications that use Net::DNS to process DNS data. This could occur when an application parses specially crafted DNS responses containing an EDNS EXTENDED-ERROR option with malicious data in the EXTRA-TEXT field. When supported by the application's context, this could lead to the execution of commands on the affected system.

Arbitrary code execution on server.
Malicious DNS data processed by application.
System compromise through command injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, ownership of this vulnerability lies with teams managing Perl applications that utilize the Net::DNS library. The immediate first step is to identify all instances of the affected library, confirm their reachability and criticality, and then assign an accountable owner to plan remediation based on the assessed risk.

Application owners should investigate library usage.
Verify application context and exposure.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Net::DNS Perl module?

Net::DNS is a collection of software modules used in the Perl programming language to perform DNS lookups and process DNS data. It acts as a foundational toolset for developers building applications that need to communicate with DNS servers or interpret complex DNS packets. Because it handles the intricacies of parsing network-transmitted DNS records, it is frequently integrated into a wide range of networking utilities, scripts, and monitoring tools that rely on the Perl ecosystem.

Why does CVE-2026-64193 cause remote code execution?

This vulnerability is classified as CWE-95, or Improper Neutralization of Directives in Dynamically Evaluated Code. It occurs because the library uses Perl's eval function to process data within DNS extended error messages. If the input contains specific backtick characters, the system may treat them as commands to be executed rather than simple text. By failing to sanitize this input properly, the library unintentionally provides a path for unauthorized command execution when it processes malicious DNS data.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted DNS response containing an EDNS EXTENDED-ERROR option with malicious data in the EXTRA-TEXT field. The vulnerability only manifests if the application specifically calls the affected function while in an array context. If the application does not trigger this specific parsing logic or if it processes data without utilizing the vulnerable function, the code execution path is not activated.

Is my system at risk?

Halo Surface Signal notes that Net::DNS is a library, not an internet-facing service, meaning its exposure depends entirely on how your specific application uses it. If your application handles untrusted DNS traffic from the internet, the risk is higher. You should assess whether your internal Perl-based services rely on Net::DNS versions 1.55 or earlier to process DNS responses, as this determines if your environment is reachable through this attack vector.

How do I address this security issue?

Your first step is to perform an inventory of all Perl-based applications within your infrastructure to identify those utilizing Net::DNS. Once identified, confirm if these applications process DNS data in a way that triggers the vulnerable code path. Engage the owners of these specific applications to evaluate the risk and prepare for updates or configuration changes recommended by the library maintainers to mitigate the injection weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.