CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
Net::IDN::Punycode::PP Perl module before 2.590 decodes truncated punycode labels into names containing characters that were never encoded.
CVE-2026-87080 affects the pure-Perl punycode decoder in Net::IDN::Encode versions before 2.590. Truncated labels decode to names containing characters that were never encoded, which could enable IDN homograph-style spoofing in software relying on the module. The disclosure was posted to oss-security by Paul Johnson on September 22, 2026.
- Net::IDN::Punycode::PP versions before 2.590 are affected
- Truncated labels decode to characters never encoded
- Could enable IDN homograph spoofing in Perl applications
- CVEs
- CVE-2026-87080
- Organizations
- Net::IDN::EncodePerl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87080 | IDN Label Mismatch Vulnerability in Perl Punycode Decoder | 9.1 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.