Eval injection in Net::DNS via EDNS EXTENDED ERROR option (CVE-2026-64193)

Net::DNS versions through 1.55 for Perl contain an eval injection vulnerability in the parsing of the EXTRA-TEXT field of EDNS EXTENDED-ERROR options (RFC 8914). The `_decompose` method tokenises raw bytes and passes them to Perl's `eval` without escaping backtick characters, allowing a remote attacker to achieve arbitrary command execution when `$pkt->edns->option('EXTENDED-ERROR')` is called in array context. Affected versions: - through 1.55 We recommend updating to: 1.56. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/184 Details: https://vuln.today/cve/CVE-2026-64193