CVE-2026-64193 – Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

CVE ID :CVE-2026-64193

Published : July 20, 2026, 7:17 p.m. | 27 minutes ago

Description :Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl’s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option(‘EXTENDED-ERROR’) is called in array context, for example with a payload of {0:`””`} in EXTRA-TEXT.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…