CVE-2026-87082

7.5 HIGHpublic exploit available

Published 2026-09-22 · Updated 2026-09-22

AI risk analysis

Summary: The flaw allows attackers to supply malformed UTF-8 input to Net::IDN::Punycode's encode_punycode function, causing the Perl module to hang, crash, or return incorrect Punycode labels. This occurs because the module doesn't validate UTF-8 input before processing it, leading to undefined behavior in the XS backend on newer Perls and SIGBUS issues on older ones.
Exploitability: Exploitation is moderately difficult as it requires direct calls to encode_punycode with malformed UTF-8 input, but attackers can trigger hangs, crashes, or incorrect label generation without authentication.
Blast radius: The impact is likely limited to systems using the Net::IDN::Punycode Perl module directly in applications that process user-supplied domain names or labels, potentially causing denial of service or incorrect IDN handling.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to 2.590 or later

dosidnperluntrusted-input

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label. The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected. A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-835, CWE-1286

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.