CVE-2026-64193

Net::DNS: Net::DNS: Arbitrary code execution via EDNS EXTENDED ERROR handling

Loading…

Severity

Critical

Red Hat Product Security

9.8

CVSS 3.1

Review impact separately from score.

Published · July 21, 2026

Updated · July 30, 2026

Description

A flaw was found in Net::DNS. A remote attacker can exploit a vulnerability in the handling of EDNS (Extension Mechanisms for DNS) EXTENDED ERROR options, leading to arbitrary code execution. The affected component processes the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option without properly escaping special characters, which allows for command injection. This enables an attacker to execute unauthorized commands on the system.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')