Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label.
The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected.
A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.
References
Configurations
No configuration.
History
22 Sep 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Sep 2026, 16:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
22 Sep 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-22 08:16
Updated : 2026-09-22 19:07
NVD link : CVE-2026-87082
Mitre link : CVE-2026-87082
CVE.ORG link : CVE-2026-87082
JSON object : View
Products Affected
No product.