Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.
FEDORA-EPEL-2026-8249fe4a72 (perl-Net-DNS-1.56-1.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8249fe4a72
FEDORA-EPEL-2026-9d8de529df (perl-Net-DNS-1.56-1.el10_3) has been submitted as an update to Fedora EPEL 10.3. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9d8de529df
FEDORA-EPEL-2026-9d8de529df has been pushed to the Fedora EPEL 10.3 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9d8de529df See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-8249fe4a72 has been pushed to the Fedora EPEL 10.4 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8249fe4a72 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-9d8de529df (perl-Net-DNS-1.56-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-8249fe4a72 (perl-Net-DNS-1.56-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository. If problem still persists, please make note of it in this bug report.