CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
CVE-2026-64193- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-95
- Updated
- 2026-11-02
EUVDEUVD-2026-46051
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
EUVD-2026-46051- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hwpr-jc4f-7ww3
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR....
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
GHSA-hwpr-jc4f-7ww3- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-95
- Updated
- 2026-11-02
NVD
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
CVE-2026-64193- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-95
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
DEBIAN-CVE-2026-64193- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3626
perl-Net-DNS security update
Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.
Security Fix(es):
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.(CVE-2026-64193)
- Record
OESA-2026-3626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVOESA-2026-3627
perl-Net-DNS security update
Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.
Security Fix(es):
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.(CVE-2026-64193)
- Record
OESA-2026-3627- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3871
perl-Net-DNS security update
Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.
Security Fix(es):
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.(CVE-2026-64193)
- Record
OESA-2026-3871- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.
- Record
UBUNTU-CVE-2026-64193- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0448 No score
Updated perl-Net-DNS packages fix security vulnerabilities
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. (CVE-2026-64193) Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. (CVE-2026-64194) Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. (CVE-2026-81928)
- Record
MGASA-2026-0448- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11396-1 No score
perl-Net-DNS-1.560.0-1.1 on GA media
These are all security issues fixed in the perl-Net-DNS-1.560.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11396-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21437-1 No score
Security update for perl-Net-DNS
This update for perl-Net-DNS fixes the following issues:
Changes in perl-Net-DNS:
- CVE-2026-64194: Fixed a Denial of Service via deep DNS compression pointer chains [bsc#1272214]
- CVE-2026-64193: Fixed a remote execution injection [bsc#1272212]
- Record
openSUSE-SU-2026:21437-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21859-1 No score
Security update for perl-Net-DNS
This update for perl-Net-DNS fixes the following issues:
Changes in perl-Net-DNS:
Updated to 1.570.0 (1.57):
See /usr/share/doc/packages/perl-Net-DNS/Changes .
-
Resync with IANA DNS parameters registry. -
EDNS: Add support for MQTYPE-QUERY option. -
Unbounded recursion when re-encoding message with misplaced TSIG CVE-2026-81928 bsc#1278084 -
UNIX resolver can fail in taint mode -
Documentation issue for Net::DNS::RR::RRSIG::verify() -
Denial of Service via long DNS compression chains CVE-2026-64194 bsc#1272214 -
Remote code injection via EDNS EXTENDED ERROR CVE-2026-64193 bsc#1272212 -
UNIX.pm: Unreachable code warning using Apache/mod_perl
- Record
openSUSE-SU-2026:21859-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnet-dns-perlDebian:13 |
before 1.56-0+deb13u1, plus listed versions 1.50-11.53-11.54-11.55-1 |
1.56-0+deb13u1 |
libnet-dns-perlDebian:14 |
before 1.56-1, plus listed versions 1.50-11.53-11.54-11.55-1 |
1.56-1 |
perl-Net-DNSMageia:10 From an advisory covering 3 CVEs |
before 1.570.0-1.mga10 | 1.570.0-1.mga10 |
perl-Net-DNSMageia:9 From an advisory covering 3 CVEs |
before 1.360.0-1.1.mga9 | 1.360.0-1.1.mga9 |
perl-Net-DNSopenEuler:24.03-LTS-SP1 |
before 1.40-2.oe2403sp1 | 1.40-2.oe2403sp1 |
perl-Net-DNSopenEuler:24.03-LTS-SP3 |
before 1.40-2.oe2403sp3 | 1.40-2.oe2403sp3 |
perl-Net-DNSopenEuler:24.03-LTS-SP4 |
before 1.40-2.oe2403sp4 | 1.40-2.oe2403sp4 |
libnet-dns-perlUbuntu:14.04:LTS |
All versions, plus listed versions 0.68-1.20.68-1.2build1 |
None known |
libnet-dns-perlUbuntu:16.04:LTS |
All versions, plus listed versions 0.81-20.81-2build1 |
None known |
libnet-dns-perlUbuntu:18.04:LTS |
All versions, plus listed versions 1.10-2 |
None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libnet-dns-perlUbuntu:20.04:LTS |
All versions, plus listed versions 1.20-11.21-11.22-1 |
None known |
libnet-dns-perlUbuntu:22.04:LTS |
All versions, plus listed versions 1.29-11.32-11.33-1 |
None known |
libnet-dns-perlUbuntu:24.04:LTS |
All versions, plus listed versions 1.39-2ubuntu11.40-1ubuntu11.44-1ubuntu1 |
None known |
libnet-dns-perlUbuntu:26.10 |
All versions, plus listed versions 1.54-1ubuntu11.55-1ubuntu1 |
None known |
libnet-dns-perlUbuntu:26.04:LTS |
All versions, plus listed versions 1.50-1ubuntu11.53-1ubuntu11.54-1ubuntu1 |
None known |
perl-Net-DNSopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.560.0-1.1 | 1.560.0-1.1 |
perl-Net-DNSopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 1.460.0-bp160.2.1 | 1.460.0-bp160.2.1 |
perl-Net-DNSopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 1.570.0-bp160.1.1 | 1.570.0-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-64193 is a critical vulnerability (CVSS 9.8) in Nlnetlabs Net::dns, published July 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in libnet-dns-perl 1.56-0+deb13u1.
References
net-dns.org/blog
rt.cpan.org/Ticket/Display.html?id=179945
metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
openwall.com/lists/oss-security/2026/07/20/12
nvd.nist.gov/vuln/detail/CVE-2026-64193
github.com/advisories/GHSA-hwpr-jc4f-7ww3
Show 25 moreShow less
security-tracker.debian.org/tracker/CVE-2026-64193
advisories.mageia.org/MGASA-2026-0448.html
bugs.mageia.org/show_bug.cgi?id=35968
lists.debian.org/debian-security-announce/2026/msg00370.html
datatracker.ietf.org/doc/html/rfc8945
lists.fedoraproject.org/archives/list/[email protected]/message/5TS4YPB3LGX5Q5VWSYLSIQZWXJU4UMZN
lists.opensuse.org/archives/list/[email protected]/message/GGGP7EQRAUOGLVT6K5VJ7U3KCA7YMNZZ
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3626
ubuntu.com/security/CVE-2026-64193
cve.org/CVERecord?id=CVE-2026-64193
lists.security.metacpan.org/cve-announce/msg/41989543
suse.com/security/cve/CVE-2026-64193
bugzilla.suse.com/1272212