Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose tokenises the EXTRA‑TEXT field of an EDNS EXTENDED‑ERROR option and passes the result to Perl’s eval. Some escaping is performed for $ and @, but backticks are not escaped. When an application retrieves the EXTENDED‑ERROR option in array context, the eval is executed with the supplied payload. This classic command‑injection flaw (CWE‑78, CWE‑95) allows an attacker to execute arbitrary code on the host that processes the packet.

The flaw resides in all releases of the NLNETLABS Net::DNS Perl library up through version 1.55. Any system that imports this library to parse DNS traffic and that processes EDNS EXTENDED‑ERROR options without additional safeguards is potentially vulnerable. The vendor’s fix is available as version 1.56, released through CPAN and the Net::DNS project’s distribution channels.

The vulnerability carries a CVSS score of 9.8, indicating critical severity, while the EPSS score of less than 1 % implies a very low but non‑zero probability of exploitation in the wild. It is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network‑based: an adversary can craft a DNS query containing a malicious EXTENDED‑ERROR option with backticks and transmit it to the target. If the target’s application calls $pkt->edns->option('EXTENDED-ERROR') in array context, the embedded Perl eval will run the attacker’s command, giving full control over the host running Net::DNS.