critical
CVE-2026-64193
Net::DNS: Net::DNS: Arbitrary code execution via EDNS EXTENDED ERROR handling
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by Red Hat. Rated lower by Amazon (high).
Description
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine edge | perl-net-dns | 1.57-r0 |
| amazon linux 2023 | perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests | 1.56-1.amzn2023.0.1 |
| debian 13 | libnet-dns-perl | 1.56-0+deb13u1 |
| debian 14 | libnet-dns-perl | 1.56-1 |
| rapidfort amazon linux 2023 | perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests | 1.56-1.amzn2023.0.1 |
| rapidfort debian 12 | libnet-dns-perl | 0:1.56-0+deb13u1, 0:1.56-1 |
| rapidfort debian 13 | libnet-dns-perl | 0:1.56-0+deb13u1, 0:1.56-1 |
| rapidfort fedora 43 | perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests | 1.56-1.fc43 |
| rapidfort Oracle Linux 10 | perl-Net-DNS, perl-Net-DNS-Nameserver, perl-Net-DNS-tests | 1.56-1.el10_3 |
Show all 17 entries from 9 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine edge | perl-net-dns | 1.57-r0 |
| amazon linux 2023 | perl-Net-DNS | 1.56-1.amzn2023.0.1 |
| amazon linux 2023 | perl-Net-DNS-Nameserver | 1.56-1.amzn2023.0.1 |
| amazon linux 2023 | perl-Net-DNS-tests | 1.56-1.amzn2023.0.1 |
| debian 13 | libnet-dns-perl | 1.56-0+deb13u1 |
| debian 14 | libnet-dns-perl | 1.56-1 |
| rapidfort amazon linux 2023 | perl-Net-DNS | 1.56-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | perl-Net-DNS-Nameserver | 1.56-1.amzn2023.0.1 |
| rapidfort amazon linux 2023 | perl-Net-DNS-tests | 1.56-1.amzn2023.0.1 |
| rapidfort debian 12 | libnet-dns-perl | 0:1.56-0+deb13u1, 0:1.56-1 |
| rapidfort debian 13 | libnet-dns-perl | 0:1.56-0+deb13u1, 0:1.56-1 |
| rapidfort fedora 43 | perl-Net-DNS | 1.56-1.fc43 |
| rapidfort fedora 43 | perl-Net-DNS-Nameserver | 1.56-1.fc43 |
| rapidfort fedora 43 | perl-Net-DNS-tests | 1.56-1.fc43 |
| rapidfort Oracle Linux 10 | perl-Net-DNS | 1.56-1.el10_3 |
| rapidfort Oracle Linux 10 | perl-Net-DNS-Nameserver | 1.56-1.el10_3 |
| rapidfort Oracle Linux 10 | perl-Net-DNS-tests | 1.56-1.el10_3 |
References
- http://www.openwall.com/lists/oss-security/2026/07/20/12
- https://access.redhat.com/security/cve/CVE-2026-64193
- https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
- https://nvd.nist.gov/vuln/detail/CVE-2026-64193
- https://rt.cpan.org/Ticket/Display.html?id=179945
- https://www.cve.org/CVERecord?id=CVE-2026-64193
- https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56