Skip to main content

Net::DNS CVE-2026-64193

| EUVDEUVD-2026-46051 CRITICAL
Eval Injection (CWE-95)
2026-07-20 CPANSec GHSA-hwpr-jc4f-7ww3
9.8
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

AV:N and PR:N/UI:N since a network DNS response triggers it without auth, but AC:H because the app must call the EXTENDED-ERROR option in array context and attacker must control the response; full CIA loss from code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 21, 2026 - 21:43 vuln.today
CVSS changed
Jul 21, 2026 - 19:22 NVD
9.8 (CRITICAL)
CVE Published
Jul 20, 2026 - 17:54 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 20, 2026 - 17:54 cve.org
CRITICAL 9.8

DescriptionCVE.org

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.

AnalysisAI

Eval-based command injection in the Net::DNS module for Perl (versions through 1.55) lets a malicious or man-in-the-middle DNS server run arbitrary shell commands on a client that parses an EDNS EXTENDED-ERROR option. The EXTRA-TEXT field is tokenised and passed to Perl's eval with escaping for $ and @ but not backticks, so a crafted response reaching option('EXTENDED-ERROR') in array context executes attacker-supplied commands. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Position malicious or on-path DNS server
Delivery
Return response with crafted EDNS EXTENDED-ERROR
Exploit
EXTRA-TEXT carries backtick command payload
Execution
App reads option in array context
Persist
Net::DNS eval executes backticks
Impact
Arbitrary command runs as app user

Vulnerability AssessmentAI

Exploitation Exploitation requires that (1) the victim runs Net::DNS ≤1.55 for Perl and processes a DNS response that includes an EDNS0 EXTENDED-ERROR (RFC 8914) option, and (2) the application code specifically calls $pkt->edns->option('EXTENDED-ERROR') in array (list) context - the exact API usage that routes EXTRA-TEXT into eval. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals conflict in an informative way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who controls a DNS server (or can man-in-the-middle DNS responses to a target) returns a response containing an EDNS EXTENDED-ERROR option whose EXTRA-TEXT holds a payload like {0:`"id > /tmp/pwned"`}. When the victim Perl application parses that response and reads the extended-error option in array context, Net::DNS passes the backtick-laden string to eval and the embedded command runs with the application's privileges. …
Remediation Upstream fix available (Net::DNS 1.55_01 developer release and 1.56 release candidate); a final tagged 1.56 stable release should be confirmed on CPAN before deployment, so treat this as 'released patched version not yet independently confirmed as GA' and upgrade to 1.56 as soon as it is published, or apply the 1.55_01 developer build in the interim per the changelog at https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all production systems using Net::DNS ≤1.55; alert application owners to the critical risk posed by any untrusted DNS traffic. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Net

View all
CVE-2026-33811 HIGH POC
7.5 May 07

Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali

CVE-2026-39836 HIGH POC
7.5 May 07

Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by

CVE-2018-17848 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "

CVE-2018-17847 HIGH POC
7.5 Oct 01

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading

CVE-2018-17143 HIGH POC
7.5 Sep 17

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a

CVE-2018-17142 HIGH POC
7.5 Sep 17

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "pani

CVE-2018-17075 HIGH POC
7.5 Sep 16

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic:

CVE-2026-45491 MEDIUM POC
5.5 Jun 09

Local file tampering via symlink/junction following in Microsoft .NET runtimes 8.0, 9.0, and 10.0 allows a local unauthe

CVE-2024-43498 CRITICAL
9.8 Nov 12

.NET and Visual Studio Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-36049 CRITICAL
9.8 Nov 14

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this v

CVE-2024-57854 CRITICAL
9.1 Mar 05

Weak PRNG in Net::NSCA::Client through 0.009002 for Perl. Patch available.

CVE-2026-11373 CRITICAL
9.1 Jun 22

Metric injection in the Perl module Net::Statsite::Client through version 1.1.0 allows attackers controlling metric name

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-64193 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy