Most recent entries from all

BREW-fpdns-CVE-2026-64193 — Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Affected: Homebrew: fpdns

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.

EUVD-2026-339265

fkie_cve-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

GHSA-hwpr-jc4f-7ww3

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

OESA-2026-3626 — perl-Net-DNS security update

Affected: openEuler:24.03-LTS-SP1: perl-Net-DNS

Net :: DNS is a collection of Perl&apos;s Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions. Security Fix(es):

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

openSUSE-SU-2026:11396-1 — perl-Net-DNS-1.560.0-1.1 on GA media

perl-Net-DNS-1.560.0-1.1 on GA media

UBUNTU-CVE-2026-64193

Affected: Ubuntu:14.04:LTS: libnet-dns-perl, Ubuntu:16.04:LTS: libnet-dns-perl, Ubuntu:18.04:LTS: libnet-dns-perl, Ubuntu:20.04:LTS: libnet-dns-perl, Ubuntu:22.04:LTS: libnet-dns-perl, Ubuntu:24.04:LTS: libnet-dns-perl, Ubuntu:26.04:LTS: libnet-dns-perl

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.