CVE-2026-87080

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87080
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87080.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87080
Downstream
Published
2026-09-22T07:25:03Z
Modified
2026-09-24T03:46:56Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
Details

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.

The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label.

Net::IDN::Punycode uses this backend wherever the XS does not build.

The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-1286"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87080.json"
}
References

Affected packages

Git / github.com/robrwo/net-idn-encode

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/net-idn-encode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b903cf0aeb82ff60e98e180a26daf3f9943f167
Fixed
48436c7ad2c4d4c6398110e11133754fc476a783
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.590"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Net-IDN-Encode-0.*
Net-IDN-Encode-0.999_20100110
Net-IDN-Encode-0.99_20080914
Net-IDN-Encode-0.99_20080919
Net-IDN-Encode-0.99_20091216
Net-IDN-Encode-0.99_20091231
Net-IDN-Encode-1.*
Net-IDN-Encode-1.000
Net-IDN-Encode-1.999_20120107
Net-IDN-Encode-1.999_20120108
Net-IDN-Encode-2.*
Net-IDN-Encode-2.000
Net-IDN-Encode-2.000_20120110
Net-IDN-Encode-2.001
Net-IDN-Encode-2.002
Net-IDN-Encode-2.003
Net-IDN-Encode-2.003_2013122700
Net-IDN-Encode-2.003_2013122701
Net-IDN-Encode-2.003_2013880700
Net-IDN-Encode-2.003_2013881000
Net-IDN-Encode-2.005
Net-IDN-Encode-2.099_20131225
Net-IDN-Encode-2.099_20131226
Net-IDN-tools-0.*
Net-IDN-tools-0.99_20070912
v2.*
v2.501
v2.502

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87080.json"