CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Perl Net::IDN::UTS46 before 2.590 can exhaust CPU on overlong labels.
CVE-2026-87081 affects Net::IDN::UTS46 in Perl's Net-IDN-Encode before version 2.590. The to_ascii function performs quadratic punycode encoding of an overlong label before applying its length check, which can exhaust CPU. Paul Johnson reported the issue on oss-security, pointing to the MetaCPAN distribution and GitHub repository. The post does not report in-the-wild exploitation.
38