CVE-2026-64193: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net::DNS (Perl)to a version that resolves this vulnerability.Fixed in 1.56
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64193?
CVE-2026-64193 has a risk rating of 30, indicating a significant vulnerability.
How do I fix CVE-2026-64193?
To fix CVE-2026-64193, upgrade to Net::DNS version 1.56 or later.
What type of vulnerability is CVE-2026-64193?
CVE-2026-64193 is a remote execution injection vulnerability in Net::DNS for Perl.
What is affected by CVE-2026-64193?
CVE-2026-64193 affects all versions of Net::DNS up to and including version 1.55.
How does CVE-2026-64193 affect my system?
CVE-2026-64193 allows remote attackers to execute arbitrary code via a crafted EDNS EXTENDED ERROR.