CVE-2026-19954

The pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 queries WHOIS for the wrong name when given some Unicode domain names. It encodes each non-ASCII label directly with Net::IDN::Punycode and prepends xn--, and aside from lowercasing ASCII and Cyrillic letters it skips IDNA mapping and normalization, so a label with other uppercase letters or not in NFC becomes a different A-label than its proper IDNA form (for example U+00C9 followed by "cole" becomes xn--cole-pka instead of xn--cole-9oa). Anyone relying on that lookup can receive registration data for a different domain and may act on it; a party who controls the mis-encoded name could supply misleading ownership information. Only the pwhois tool is affected; the Net::Whois::Raw library modules are not. There is no known public proof of concept, no listing on the CISA KEV catalog, and no evidence of exploitation in the wild.

What to do: Upgrade Net::Whois::Raw to 2.99044 or later so the bundled pwhois tool applies full IDNA mapping and normalization. Until then, do not trust pwhois results for Unicode domain names: convert the name with a correct IDNA implementation before lookup, or use another WHOIS client, and re-check any earlier lookups of labels with non-ASCII uppercase letters or non-NFC text.