critical9.8
CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.
Impact
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Net::DNS | Net::DNS | through 1.55 |
Versions were read from the advisory text. No structured product data has been published for this record yet.