{"id":"CVE-2026-64193","aliases":["DEBIAN-CVE-2026-64193","EUVD-2026-46051","GHSA-hwpr-jc4f-7ww3","MGASA-2026-0448","OESA-2026-3626","OESA-2026-3627","OESA-2026-3871","UBUNTU-CVE-2026-64193","openSUSE-SU-2026:11396-1","openSUSE-SU-2026:21437-1","openSUSE-SU-2026:21859-1"],"status":"published","title":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01439,"percentile":0.73384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-95"],"published":"2026-07-20T17:54:42Z","modified":"2026-10-25T09:47:38Z","fixes":[{"ecosystem":"Debian:13","package":"libnet-dns-perl","fixed_in":["1.56-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnet-dns-perl","fixed_in":["1.56-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Net-DNS","fixed_in":["1.40-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-Net-DNS","fixed_in":["1.40-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-Net-DNS","fixed_in":["1.40-2.oe2403sp4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-0+deb13u1"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}],"versions":["1.50-1","1.53-1","1.54-1","1.55-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.360.0-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40-2.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.68-1.2","0.68-1.2build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.81-2","0.81-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20-1","1.21-1","1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29-1","1.32-1","1.33-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39-2ubuntu1","1.40-1ubuntu1","1.44-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.54-1ubuntu1","1.55-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-dns-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.50-1ubuntu1","1.53-1ubuntu1","1.54-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.560.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.460.0-bp160.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Net-DNS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.570.0-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"nlnetlabs","product":"net::dns"}],"references":[{"url":"https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179945","tags":["issue-tracking","web","report"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes","tags":["release-notes","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/20/12"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64193","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hwpr-jc4f-7ww3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-64193","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0448.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35968","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/20/13","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=179946","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00370.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/02/1","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L245-262","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L62-73","tags":["web"]},{"url":"https://datatracker.ietf.org/doc/html/rfc8945#section-5.2","tags":["web"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=181125","tags":["web"]},{"url":"https://metacpan.org/release/NLNETLABS/Net-DNS-1.57/changes","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TS4YPB3LGX5Q5VWSYLSIQZWXJU4UMZN/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GGGP7EQRAUOGLVT6K5VJ7U3KCA7YMNZZ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3626","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3627","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3871","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-64193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64193","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41989543/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64194","tags":["web"]},{"url":"https://bugzilla.suse.com/1272212","tags":["report"]},{"url":"https://bugzilla.suse.com/1272214","tags":["report"]},{"url":"https://bugzilla.suse.com/1278084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81928","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-64193","title":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T17:54:42.087Z","modified":"2026-07-21T18:55:09.291Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:19:58.214427Z"}],"euvd":[{"id":"EUVD-2026-46051","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T17:54:42Z","modified":"2026-07-21T18:55:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:46.900828Z"}],"ghsa":[{"id":"GHSA-hwpr-jc4f-7ww3","title":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR....","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T21:31:49Z","modified":"2026-07-21T21:33:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T15:09:38.678188Z"}],"nvd":[{"id":"CVE-2026-64193","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T19:17:30.047Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-95"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"DEBIAN-CVE-2026-64193","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.  Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T19:17:30.047Z","modified":"2026-10-25T09:47:38.105258629Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:58.307012Z"},{"id":"OESA-2026-3626","title":"perl-Net-DNS security update","description":"Net :: DNS is a collection of Perl\u0026amp;apos;s Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.\r\n\r\nSecurity Fix(es):\n\nNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl\u0026apos;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u0026gt;edns-\u0026gt;option(\u0026apos;EXTENDED-ERROR\u0026apos;) is called in array context, for example with a payload of {0:`\u0026quot;\u0026lt;command\u0026gt;\u0026quot;`} in EXTRA-TEXT.(CVE-2026-64193)","status":"published","published":"2026-09-05T15:03:17Z","modified":"2026-09-05T15:16:24.080117006Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3627","title":"perl-Net-DNS security update","description":"Net :: DNS is a collection of Perl\u0026amp;apos;s Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.\r\n\r\nSecurity Fix(es):\n\nNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl\u0026apos;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u0026gt;edns-\u0026gt;option(\u0026apos;EXTENDED-ERROR\u0026apos;) is called in array context, for example with a payload of {0:`\u0026quot;\u0026lt;command\u0026gt;\u0026quot;`} in EXTRA-TEXT.(CVE-2026-64193)","status":"published","published":"2026-09-05T15:03:17Z","modified":"2026-09-05T15:16:24.212219118Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3871","title":"perl-Net-DNS security update","description":"Net :: DNS is a collection of Perl\u0026amp;apos;s Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions.\r\n\r\nSecurity Fix(es):\n\nNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.\n\nNet::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl\u0026apos;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u0026gt;edns-\u0026gt;option(\u0026apos;EXTENDED-ERROR\u0026apos;) is called in array context, for example with a payload of {0:`\u0026quot;\u0026lt;command\u0026gt;\u0026quot;`} in EXTRA-TEXT.(CVE-2026-64193)","status":"published","published":"2026-09-14T16:35:11Z","modified":"2026-09-13T16:45:51.158400311Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-64193","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-\u003eedns-\u003eoption('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`\"\u003ccommand\u003e\"`} in EXTRA-TEXT.","status":"published","published":"2026-07-20T19:17:00Z","modified":"2026-10-17T13:00:33.588360584Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:48.57134Z"},{"id":"MGASA-2026-0448","title":"Updated perl-Net-DNS packages fix security vulnerabilities","description":"Net::DNS versions through 1.55 for Perl allow remote execution injection\nvia EDNS EXTENDED ERROR. (CVE-2026-64193)\nNet::DNS versions through 1.55 for Perl allow Denial of Service via deep\nDNS compression pointer chains. (CVE-2026-64194)\nNet::DNS versions before 1.57 for Perl allow memory exhaustion via\nunbounded recursion in sig_data when re-encoding a message with a\nmisplaced TSIG record. (CVE-2026-81928)\n","status":"published","published":"2026-09-24T16:06:15Z","modified":"2026-09-24T16:15:03.338436977Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11396-1","title":"perl-Net-DNS-1.560.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Net-DNS-1.560.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:27.222151577Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21437-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issues:\n\nChanges in perl-Net-DNS:\n\n- CVE-2026-64194: Fixed a Denial of Service via deep DNS compression pointer chains [bsc#1272214]\n- CVE-2026-64193: Fixed a remote execution injection [bsc#1272212]\n","status":"published","published":"2026-07-22T20:52:16Z","modified":"2026-07-24T17:16:08.604357306Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21859-1","title":"Security update for perl-Net-DNS","description":"This update for perl-Net-DNS fixes the following issues:\n\nChanges in perl-Net-DNS:\n\nUpdated to 1.570.0 (1.57):\n\nSee /usr/share/doc/packages/perl-Net-DNS/Changes .\n\n  -     Resync with IANA DNS parameters registry.\n  -     EDNS: Add support for MQTYPE-QUERY option.\n  -     Unbounded recursion when re-encoding message with misplaced TSIG CVE-2026-81928 bsc#1278084\n  -     UNIX resolver can fail in taint mode\n\n  -     Documentation issue for Net::DNS::RR::RRSIG::verify()\n  -     Denial of Service via long DNS compression chains CVE-2026-64194 bsc#1272214\n  -     Remote code injection via EDNS EXTENDED ERROR CVE-2026-64193 bsc#1272212\n  -     UNIX.pm: Unreachable code warning using Apache/mod_perl\n","status":"published","published":"2026-09-15T13:20:42Z","modified":"2026-09-17T18:23:16.206853539Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}