https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:05:40 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64193 <p><strong>Affected:</strong> NLNETLABS Net::DNS</p> <p>Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.</p> <p>Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl&#39;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-&gt;edns-&gt;option(&#39;EXTENDED-ERROR&#39;) is called in array context, for example with a payload of {0:`&#34;&lt;command&gt;&#34;`} in EXTRA-TEXT.</p> <p><strong>Affected:</strong> NLNETLABS Net::DNS</p> <p>Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.</p> <p>Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl&#39;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-&gt;edns-&gt;option(&#39;EXTENDED-ERROR&#39;) is called in array context, for example with a payload of {0:`&#34;&lt;command&gt;&#34;`} in EXTRA-TEXT.</p> https://vulnerability.circl.lu/vuln/cve-2026-64193