Remote Code Execution Vulnerability in Net::DNS by NLNETLABS
CVE-2026-64193
Currently unrated
What is CVE-2026-64193?
The vulnerability in Net::DNS allows attackers to execute arbitrary commands through a remote code execution vector. This is achieved by exploiting the parsing method for the EDNS EXTENDED-ERROR option. Specifically, the vulnerable method, Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose, inadequately handles the payload in the EXTRA-TEXT field, permitting the injection of commands when the extended error option is processed in array context. This flaw opens the door for malicious exploitation, where an attacker could deliver a payload formulated to execute commands within the Perl environment.
Affected Version(s)
Net::DNS 0 <= 1.55