Net::DNS EUVD-2026-46051

Exploitation requires that (1) the victim runs Net::DNS ≤1.55 for Perl and processes a DNS response that includes an EDNS0 EXTENDED-ERROR (RFC 8914) option, and (2) the application code specifically calls $pkt->edns->option('EXTENDED-ERROR') in array (list) context - the exact API usage that routes EXTRA-TEXT into eval. The attacker must control or be on-path for the DNS response (a malicious authoritative/recursive server or a MITM position). Limiting factors: exploitation does NOT trigger merely from receiving a packet in scalar context, so applications not requesting this option in list context are not affected; there is no authentication or user interaction required at the packet level (PR:N/UI:N), but the array-context code pattern is a non-default application behavior that meaningfully narrows the exposed population.

Signals conflict in an informative way. CVSS 3.1 is 9.8 (AV:N/AC:L/PR:N/UI:N, full CIA loss) and SSVC rates Technical Impact 'total' and Automatable 'yes', which argues for high priority. However SSVC Exploitation is 'none', it is absent from CISA KEV, and EPSS is only 0.41% (34th percentile), indicating no observed or predicted mass exploitation. The critical caveat is that exploitation is not truly zero-condition despite PR:N/UI:N: the description states code execution occurs only when the consuming application calls $pkt->edns->option('EXTENDED-ERROR') in array (list) context. That is application-dependent and not a default of merely receiving a packet, so real-world exposure is narrower than the 9.8 implies. Net verdict: a genuinely severe code-execution bug worth prompt patching for anyone running Perl software that inspects EDNS extended errors, but current telemetry points to no widespread or automated exploitation yet.

An attacker who controls a DNS server (or can man-in-the-middle DNS responses to a target) returns a response containing an EDNS EXTENDED-ERROR option whose EXTRA-TEXT holds a payload like {0:"id > /tmp/pwned"}. When the victim Perl application parses that response and reads the extended-error option in array context, Net::DNS passes the backtick-laden string to eval and the embedded command runs with the application's privileges. The advisory publishes the payload form but this is not confirmed as active in-the-wild exploitation.