diff --git a/BUILD.md b/BUILD.md
index 27c8a77..bc917b0 100644
--- a/BUILD.md
+++ b/BUILD.md
@@ -489,9 +489,10 @@ Deliberately not built for riscv64:
   Test::XML) are EPEL-only as well, so it can neither be built nor installed without EPEL;
   xCAT uses it for HP blade and VirtualBox support only.
 
-perl-Net-DNS is built from `perl-Net-DNS/Net-DNS.spec` at 1.47, the release EPEL 10 ships,
-so the riscv64 repo carries the same resource records as the EPEL-fed repos. xCAT needs the
-KEY record, which release 0.80 left to the separate Net::DNS::SEC distribution. This spec
+perl-Net-DNS is built from `perl-Net-DNS/Net-DNS.spec` at 1.57. xCAT needs the KEY record,
+which release 0.80 left to the separate Net::DNS::SEC distribution. 1.57 is newer than the
+1.47 that EPEL 10 ships, because 1.56 and 1.57 fix CVE-2026-64193, CVE-2026-64194 and an
+unbounded recursion on TSIG. This spec
 does not take the EPEL-only perl(Net::LibIDN2) BuildRequires of the EPEL package:
 Net::DNS treats Net::LibIDN2 as optional and uses it for internationalised names only.
 
diff --git a/packages-manifest.conf b/packages-manifest.conf
index 7c52ab1..cc38cbb 100644
--- a/packages-manifest.conf
+++ b/packages-manifest.conf
@@ -180,7 +180,7 @@ perl-Crypt-Rijndael=1.13
 perl-Digest-SHA1=2.13
 perl-Expect=1.35
 perl-Mail-Sender=0.903
-perl-Net-DNS=1.47
+perl-Net-DNS=1.57
 perl-Net-IP=1.26
 perl-Path-Class=0.37
 
diff --git a/perl-Net-DNS/Buildnote b/perl-Net-DNS/Buildnote
index fb193ac..4f632ee 100644
--- a/perl-Net-DNS/Buildnote
+++ b/perl-Net-DNS/Buildnote
@@ -1,6 +1,6 @@
 How to build the perl-Net-DNS
 
-1. cp the Net-DNS-1.47.tar.gz to the rpmbuild/SOURCES/
+1. cp the Net-DNS-1.57.tar.gz to the rpmbuild/SOURCES/
 2. cp the Net-DNS.spec to the rpmbuild/SPECS/
 3. cd rpmbuild/SPECS/
 4. rpmbuild -bb Net-DNS.spec (Net::DNS is pure perl, so the rpm is noarch and one
diff --git a/perl-Net-DNS/Net-DNS-1.47.tar.gz b/perl-Net-DNS/Net-DNS-1.47.tar.gz
deleted file mode 100644
index 305ec27..0000000
Binary files a/perl-Net-DNS/Net-DNS-1.47.tar.gz and /dev/null differ
diff --git a/perl-Net-DNS/Net-DNS-1.57.tar.gz b/perl-Net-DNS/Net-DNS-1.57.tar.gz
new file mode 100644
index 0000000..561e63e
Binary files /dev/null and b/perl-Net-DNS/Net-DNS-1.57.tar.gz differ
diff --git a/perl-Net-DNS/Net-DNS.spec b/perl-Net-DNS/Net-DNS.spec
index f839b4b..e123bb0 100644
--- a/perl-Net-DNS/Net-DNS.spec
+++ b/perl-Net-DNS/Net-DNS.spec
@@ -2,7 +2,7 @@
 #   - Net::DNS -
 #   This spec file was automatically generated by cpan2rpm [ver: 2.028]
 #   The following arguments were used:
-#       ./Net-DNS-1.47.tar.gz
+#       ./Net-DNS-1.57.tar.gz
 #   For more information on cpan2rpm please visit: http://perl.arix.com/
 #
 
@@ -13,7 +13,7 @@
 
 name:      perl-Net-DNS
 summary:   Net-DNS - Perl DNS resolver module
-version:   1.47
+version:   1.57
 release:   1
 vendor:    Olaf Kolkman <olaf@net-dns.org>
 packager:  Arix International <cpan2rpm@arix.com>
@@ -23,7 +23,7 @@ url:       http://www.cpan.org
 buildroot: %{_tmppath}/%{name}-%{version}-%(id -u -n)
 buildarch: noarch
 prefix:    %(echo %{_prefix})
-source:    Net-DNS-1.47.tar.gz
+source:    Net-DNS-1.57.tar.gz
 
 # cpan2rpm specs carry no BuildRequires; an EL10 buildroot has neither perl nor make, and
 # perl-generators is what makes rpm compute the perl(...) Requires.
@@ -146,6 +146,11 @@ find %{buildroot}%{_prefix}             \
 %defattr(-,root,root)
 
 %changelog
+* Tue Sep 29 2026 xCAT build - 1.57-1
+- Net::DNS 1.57. 1.47 carries CVE-2026-64193 (code injection via EDNS
+  EXTENDED-ERROR) and CVE-2026-64194 (deep compression pointer chains),
+  fixed in 1.56, and unbounded recursion on a misplaced TSIG, fixed in 1.57.
+
 * Sat Sep 05 2026 xCAT build - 1.47-1
 - Net::DNS 1.47. Release 0.80 leaves the DNSSEC records to Net::DNS::SEC, so
   Net::DNS::RR->new("<key>. IN KEY ...") dies and xCAT makedns fails. 1.47 is