CVE-2026-64193
Gravedad CVSS v3.1:
CRÍTICA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
20/07/2026
Última modificación:
21/07/2026
Descripción
*** Pendiente de traducción *** Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.<br />
<br />
Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl&#39;s eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option(&#39;EXTENDED-ERROR&#39;) is called in array context, for example with a payload of {0:`""`} in EXTRA-TEXT.
Impacto
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA