CPANSA-Net-IDN-Encode-2026-87081: Net-IDN-Encode vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-09-22T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-09-22T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 7.5 | Severity | High |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.
to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.
Vulnerabilities
CVE-2026-87081
Vulnerability DescriptionNet::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.
to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.
| Weakness | CWE-407 : Inefficient Algorithmic Complexity |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Net-IDN-Encode less than 2.590 |
|
Fixed
- Net-IDN-Encode greater than or equal 2.590
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Net-IDN-Encode-2026-87081 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-net-idn-encode-2026-87081.json - https://github.com/robrwo/Net-IDN-Encode/commit/5ac3315131264670efcd3a29857b651506dfee8e.patch external
https://github.com/robrwo/Net-IDN-Encode/commit/5ac3315131264670efcd3a29857b651506dfee8e.patch - https://github.com/robrwo/Net-IDN-Encode/commit/ea34f812d7dc67f3b211f4d92e74c6a7e24d764a.patch external
https://github.com/robrwo/Net-IDN-Encode/commit/ea34f812d7dc67f3b211f4d92e74c6a7e24d764a.patch - https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes external
https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes - http://www.openwall.com/lists/oss-security/2026/09/22/16 external
http://www.openwall.com/lists/oss-security/2026/09/22/16 - CVE-2026-87081 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-87081
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Tue Sep 22 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/