CVE-2026-64193

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-641947.5Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follo CVE-2026-641957.3There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation req CVE-2026-641967.3There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end CVE-2026-641977.3There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end CVE-2026-641987.3There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few byt CVE-2026-641997.3There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside t CVE-2026-64206.3A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vuln CVE-2026-642007.3There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past th CVE-2026-642017.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642027.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642037.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe CVE-2026-642047.8There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code exe