CVE-2026-64193
Received Received - Intake

Remote Code Execution in Net::DNS Perl Module

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: CPANSec

Description
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64193
EUVD
EUVD-2026-46051

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
net_dns net_dns to 1.55 (inc)
net-dns net_dns 1.55
net-dns net_dns 1.56

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote execution injection flaw in Net::DNS versions through 1.55 for Perl. It occurs when parsing the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option. The code tokenizes raw bytes and uses Perl's eval function, which allows command execution if backticks are present in the payload. Exploitation requires calling $pkt->edns->option('EXTENDED-ERROR') in array context with a malicious payload.

Detection Guidance

To detect this vulnerability, check the installed version of Net::DNS on your system. Run: perl -MNet::DNS -e 'print $Net::DNS::VERSION' If the version is 1.55 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary commands on systems using vulnerable Net::DNS versions. If your application processes DNS responses with EDNS EXTENDED-ERROR options, an attacker could inject malicious commands via DNS responses, potentially leading to remote code execution or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches or unauthorized access to sensitive information. Such incidents may violate compliance requirements under GDPR (data protection), HIPAA (health data security), or other regulations that mandate protection against remote code execution and unauthorized data access.

Mitigation Strategies

Immediately upgrade Net::DNS to version 1.56 or later. Use: cpan upgrade Net::DNS or cpanm Net::DNS::1.56. Also review any code using $pkt->edns->option('EXTENDED-ERROR') in array context to ensure proper input handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart