CVE-2026-87080 Details
Description
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
A vulnerability exists in Net::IDN::Punycode::PP versions prior to 2.590 for Perl. The issue arises because the pure-Perl decoder improperly processes truncated labels, leading to the inclusion of characters that were not originally encoded. This occurs because the decoder reads one digit at a time and uses a four-argument substring method that can return an empty string when the end of the input is reached. The empty string is interpreted as a digit value that falls below the valid range, causing the decoder to incorrectly generate an additional code point. This behavior creates a discrepancy between the pure-Perl and XS backend decoders, allowing for manipulation of the output based on the chosen backend.
Users are advised to upgrade to Net-IDN-Encode version 2.590-TRIAL or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/Net-IDN-Encode/commit/48436c7ad2c4d4c6398110e11133754fc476a783.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/09/22/15 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Net::IDN::Punycode::PP | < 2.590 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CVE |
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | CPANSec |