{"id":"CVE-2026-87081","published":"2026-09-22T08:16:40.863","lastModified":"2026-09-22T19:07:00.983","description":"Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.\n\nto_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-407"],"vendors":[],"products":[],"references":[{"url":"https://github.com/robrwo/Net-IDN-Encode/commit/5ac3315131264670efcd3a29857b651506dfee8e.patch","tags":[]},{"url":"https://github.com/robrwo/Net-IDN-Encode/commit/ea34f812d7dc67f3b211f4d92e74c6a7e24d764a.patch","tags":[]},{"url":"https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/22/16","tags":[]}],"exploitRefs":[{"url":"https://github.com/robrwo/Net-IDN-Encode/commit/5ac3315131264670efcd3a29857b651506dfee8e.patch","tags":[]},{"url":"https://github.com/robrwo/Net-IDN-Encode/commit/ea34f812d7dc67f3b211f4d92e74c6a7e24d764a.patch","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to cause CPU exhaustion by exploiting a quadratic time complexity issue in Net::IDN::UTS46's punycode encoding. An attacker can craft malicious domain names that trigger expensive processing during DNS label validation, leading to denial of service.","exploitability":"Exploitation is relatively straightforward with no special preconditions required; attackers simply need to provide a specially crafted domain name with many distinct non-ASCII characters to trigger the quadratic encoding behavior.","blast_radius":"The impact could be significant across any system processing DNS lookups or email addresses through this library, potentially affecting web applications, mail servers, and authentication systems that use Perl's IDN handling.","remediation":"Upgrade to 2.590 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","idn","perl","dns"],"model":"garnet-coder","analyzedAt":"2026-10-18T16:14:42.636Z"}}