Vulnerability · Published Jul 20, 2026 · Assigned by CPANSec
CVE-2026-64193Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR
Critical 9.8
In plain English
A critical-severity security flaw in Net::DNS from NLNETLABS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | libnet-dns-perl | 1.56-0+deb13u1 | DEBIAN-CVE-2026-64193 |
| Debian:14 | libnet-dns-perl | 1.56-1 | DEBIAN-CVE-2026-64193 |
| Ubuntu:22.04:LTS | libnet-dns-perl | no fix listed | UBUNTU-CVE-2026-64193 |
| Ubuntu:24.04:LTS | libnet-dns-perl | no fix listed | UBUNTU-CVE-2026-64193 |
| Ubuntu:26.04:LTS | libnet-dns-perl | no fix listed | UBUNTU-CVE-2026-64193 |
| Ubuntu:26.10 | libnet-dns-perl | no fix listed | UBUNTU-CVE-2026-64193 |
Affected products (as reported)
Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H