CVE-2026-64193: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::R

This week

CRITICAL 9.8REMOTE

CVE-2026-64193 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.4% (top 27%)
CISA exploited list	No
Weakness	CWE-95
Published	2026-07-20
Last modified	2026-10-24

Publisher (CNA): CPANSec

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-07-20 19:17 UTCPublished CVE record published
2026-10-24 20:10 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · conda · FIXED · 26.9.4-2.fc46 · FEDORA-2026-09931756f1 · source

sudo dnf upgrade --advisory=FEDORA-2026-09931756f1

Debian 12 · libnet-dns-perl · NOT AFFECTED

Debian 13 · libnet-dns-perl · FIXED · 1.56-0+deb13u1

sudo apt update && sudo apt install --only-upgrade libnet-dns-perl dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libnet-dns-perl)" ge "1.56-0+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 6 · perl-Net-DNS · NOT AFFECTED

RHEL 7 · perl-Net-DNS · NOT AFFECTED

RHEL 8 · perl-Net-DNS · NOT AFFECTED

RHEL 9 · perl-Net-DNS · NOT AFFECTED

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-2046 · source

sudo dnf update --advisory=ALAS2023-2026-2046

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-64193?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-64193 being exploited?

CVE-2026-64193 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-64193 affect?

CVE-2026-64193 affects affected software. Severity is critical (CVSS 9.8). Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw b

How urgent is CVE-2026-64193?

Priority 61/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Perl vulnerabilities

References

← Back to latest CVEs