CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

• CWE-95

• https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
• https://rt.cpan.org/Ticket/Display.html?id=179945
• https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
• http://www.openwall.com/lists/oss-security/2026/07/20/12

Published

Jul 20, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64188In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64189In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6419The WishList Member plugin for WordPress is vulnerable to Pr…8.8
• CVE-2026-64190In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64191In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64192In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64194Net::DNS versions through 1.55 for Perl allow Denial of Serv…7.5
• CVE-2026-6420A flaw was found in Keylime. An attacker with root access on…6.3
• CVE-2026-64205In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64206In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64207In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64208In the Linux kernel, the following vulnerability has been re…7.5