by Kastro
Paper/Archive/CVE-2026-64193

CVE-2026-64193

NLNETLABS Net::DNS — Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.2.732 × 2014.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

Affected

ProductAffectedFixed inSource
Net::DNS≤ 1.55–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refnet-dns.org/blog/#release-candidate-for-netdns-1.56refrt.cpan.org/Ticket/Display.html?id=179945refmetacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changesrefopenwall.com/lists/oss-security/2026/07/20/12