CVE-2026-64193Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-95

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Open Source Security mailing list@oss_security91d
Disclosure
Perl CPAN Net::DNS through 1.55 CVE-2026-64193: Remote execution injection via EDNS EXTENDED ERROR https://www.openwall.com/lists/oss-security/2026/07/20/12 CVE-2026-64194: DoS via deep DNS compression pointer chains https://www.openwall.com/lists/oss-security/2026/07/20/13
Post summary
Two new CVEs in Perl CPAN Net::DNS are disclosed – one allows remote execution through EDNS extended error handling, the other causes DoS via deep DNS compression pointer chains; no PoC, exploit, or patch details are provided.
00000163
4.7K followersView on X
SecAlerts@SecAlertsCo91d
Disclosure
🔎 CVE-2026-64193: Net::DNS through 1.55 for Perl has a critical 9.8 RCE flaw. EDNS EXTENDED-ERROR parsing in _decompose allows remote injection with no auth needed. Upgrade to 1.56. #Perl #infosec https://secalerts.co/vulnerability/CVE-2026-64193?utm_campaign=x https://t.co/t36GUaO7Zq
Post summary
The advisory discloses a critical 9.8 RCE flaw in Net::DNS 1.55 for Perl, explaining the vulnerability mechanism and recommending an upgrade to 1.56 to remediate.
00000101
867 followersView on X

Explore more

Back to dashboard