CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode
Perl Net::IDN::Punycode before 2.590 can hang, crash, or mislabel malformed UTF-8.
Paul Johnson disclosed CVE-2026-87082 in Net::IDN::Punycode, part of the Perl Net-IDN-Encode distribution, affecting versions before 2.590. The encode_punycode function does not validate malformed UTF-8 and can hang, crash, or return an incorrect label. The report was posted to oss-security with links to the MetaCPAN distribution and the robrwo/Net-IDN-Encode repository. No exploitation is described.
- Affects Net::IDN::Punycode versions before 2.590.
- encode_punycode does not validate malformed UTF-8.
- Impact is a hang, crash, or incorrect label.
- Tracked as CVE-2026-87082 in Net-IDN-Encode.
- CVEs
- CVE-2026-87082
- Products
- Net-IDN-EncodeNet::IDN::Punycode
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87082 | DoS and Data Corruption in Perl Net::IDN::Punycode via Malformed UTF-8 | 7.5 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode Net::IDN::Punycode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.