CVE-2026-64193: nlnetlabs net::dns Eval Injection
Vulnerability summary
CVE-2026-64193 is a critical (CVSS 9.8) Eval Injection vulnerability in nlnetlabs net::dns. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 20-07-2026PublishedVulnerability first disclosed.
- 21-07-2026Last modifiedVulnerability information updated.
Description
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.44%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.65 pp
From 0.79% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libnet-dns-perl< 1.56-0+deb13u1 | < 1.56-1
Nlnetlabs1 product
- net::dns≤ 1.55
Ubuntu1 product
- libnet-dns-perlAll versions (No fix recorded)
3 vendors · 3 products
