CPANSA-Net-Whois-Raw-2026-19954: Net-Whois-Raw vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-05T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-05T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 5.4 | Severity | Medium |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.
pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa".
The Net::Whois::Raw library modules are not affected.
Vulnerabilities
CVE-2026-19954
Vulnerability DescriptionNet::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.
pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa".
The Net::Whois::Raw library modules are not affected.
| Weakness | CWE-176 : Improper Handling of Unicode Encoding |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Net-Whois-Raw less than 2.99044 |
|
Fixed
- Net-Whois-Raw greater than or equal 2.99044
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Net-Whois-Raw-2026-19954 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-net-whois-raw-2026-19954.json - https://github.com/regru/Net-Whois-Raw/issues/34 external
https://github.com/regru/Net-Whois-Raw/issues/34 - https://github.com/regru/Net-Whois-Raw/pull/35 external
https://github.com/regru/Net-Whois-Raw/pull/35 - https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes external
https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes - https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING external
https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING - https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch external
https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch - https://www.rfc-editor.org/rfc/rfc5891#section-5.2 external
https://www.rfc-editor.org/rfc/rfc5891#section-5.2 - http://www.openwall.com/lists/oss-security/2026/10/05/9 external
http://www.openwall.com/lists/oss-security/2026/10/05/9 - CVE-2026-19954 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-19954
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Mon Oct 5 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/