CVE-2026-87081

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87081
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87081.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87081
Downstream
Published
2026-09-22T07:25:22Z
Modified
2026-09-24T03:46:53Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Details

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.

to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87081.json"
}
References

Affected packages

Git / github.com/robrwo/net-idn-encode

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/net-idn-encode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b903cf0aeb82ff60e98e180a26daf3f9943f167
Fixed
5ac3315131264670efcd3a29857b651506dfee8e
Fixed
ea34f812d7dc67f3b211f4d92e74c6a7e24d764a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.590"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Net-IDN-Encode-0.*
Net-IDN-Encode-0.999_20100110
Net-IDN-Encode-0.99_20080914
Net-IDN-Encode-0.99_20080919
Net-IDN-Encode-0.99_20091216
Net-IDN-Encode-0.99_20091231
Net-IDN-Encode-1.*
Net-IDN-Encode-1.000
Net-IDN-Encode-1.999_20120107
Net-IDN-Encode-1.999_20120108
Net-IDN-Encode-2.*
Net-IDN-Encode-2.000
Net-IDN-Encode-2.000_20120110
Net-IDN-Encode-2.001
Net-IDN-Encode-2.002
Net-IDN-Encode-2.003
Net-IDN-Encode-2.003_2013122700
Net-IDN-Encode-2.003_2013122701
Net-IDN-Encode-2.003_2013880700
Net-IDN-Encode-2.003_2013881000
Net-IDN-Encode-2.005
Net-IDN-Encode-2.099_20131225
Net-IDN-Encode-2.099_20131226
Net-IDN-tools-0.*
Net-IDN-tools-0.99_20070912
v2.*
v2.501
v2.502

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87081.json"