Skip to main content

Net::DNS CVE-2026-64193

| EUVDEUVD-2026-46051 CRITICAL
Eval Injection (CWE-95)
2026-07-20 CPANSec GHSA-hwpr-jc4f-7ww3
Code Injection Red Hat Suse Net Nlnetlabs
9.8
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

AV:N and PR:N/UI:N since a network DNS response triggers it without auth, but AC:H because the app must call the EXTENDED-ERROR option in array context and attacker must control the response; full CIA loss from code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
9.8 CRITICAL
qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 21, 2026 - 21:43 vuln.today
CVSS changed
Jul 21, 2026 - 19:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 20, 2026 - 17:54 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 20, 2026 - 17:54 cve.org
CRITICAL 9.8

DescriptionCVE.org

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.

AnalysisAI

Eval-based command injection in the Net::DNS module for Perl (versions through 1.55) lets a malicious or man-in-the-middle DNS server run arbitrary shell commands on a client that parses an EDNS EXTENDED-ERROR option. The EXTRA-TEXT field is tokenised and passed to Perl's eval with escaping for $ and @ but not backticks, so a crafted response reaching option('EXTENDED-ERROR') in array context executes attacker-supplied commands. Rated CVSS 9.8; no public exploit identified at time of analysis, though the advisory publishes a working {0:"<command>"} payload, EPSS is low at 0.41%, and it is not in CISA KEV.

Technical ContextAI

Net::DNS is the de-facto DNS resolver/record library for Perl, used by clients, mail servers, and monitoring tools to send queries and parse responses. The flaw is in Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose, which handles the EXTRA-TEXT field of the EDNS0 EXTENDED-ERROR option defined in RFC 8914. Rather than treating EXTRA-TEXT as opaque data, the decoder tokenises raw wire bytes and feeds the reconstructed string to Perl's eval() to build a data structure. Escaping is applied to '$' and '@' interpolation but not to backticks, which in Perl perform command execution (qx//). This maps to CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / eval injection): untrusted network data crosses into a code-evaluation context. The CPE (cpe:2.3:a:nlnetlabs:net::dns) identifies the NLnetLabs-maintained CPAN distribution as the affected component.

RemediationAI

Upstream fix available (Net::DNS 1.55_01 developer release and 1.56 release candidate); a final tagged 1.56 stable release should be confirmed on CPAN before deployment, so treat this as 'released patched version not yet independently confirmed as GA' and upgrade to 1.56 as soon as it is published, or apply the 1.55_01 developer build in the interim per the changelog at https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes. Until upgraded, the most direct compensating control is to audit application code and avoid calling $pkt->edns->option('EXTENDED-ERROR') in array/list context, since scalar-context usage does not reach the vulnerable eval path - trade-off is that you lose structured access to the extended-error data. Where feasible, restrict which DNS resolvers the application trusts and use validated/DNSSEC-protected or local trusted resolvers to reduce the chance of a hostile server returning a malicious EXTENDED-ERROR option; this does not stop a compromised or on-path resolver. Monitor the vendor blog (https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56) and CPAN ticket #179945 for the stable release.

More in Net

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2023-38180 HIGH
7.5 Aug 08

.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-71328 HIGH POC
8.8 Sep 08

Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
CVE-2026-62886 HIGH POC
7.8 Aug 11

Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
CVE-2026-62871 HIGH POC
7.8 Aug 11

Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
CVE-2026-70354 HIGH POC
7.8 Aug 11

Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full

CVE-2026-62909 HIGH POC
7.8 Aug 11

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows

CVE-2026-62901 HIGH POC
7.5 Aug 11

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang

CVE-2026-62897 HIGH POC
7.0 Aug 11

Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
CVE-2026-62898 HIGH POC
7.5 Aug 11

Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
CVE-2026-26127 HIGH POC
7.5 Mar 10

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
CVE-2026-33811 HIGH POC
7.5 May 07

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali

Same weakness CWE-95 – Eval Injection

View all
CVE-2025-24893 CRITICAL POC
9.8
CVE-2024-21650 CRITICAL POC
10.0
CVE-2013-10051 CRITICAL POC
9.3
CVE-2013-10070 CRITICAL POC
10.0
CVE-2026-33017 CRITICAL POC
9.3
CVE-2026-19295 CRITICAL POC
9.9
CVE-2024-7954 CRITICAL POC
9.8
CVE-2024-36401 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-64193 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy