CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Perl Net::IDN::UTS46 before 2.590 can exhaust CPU on overlong labels.
CVE-2026-87081 affects Net::IDN::UTS46 in Perl's Net-IDN-Encode before version 2.590. The to_ascii function performs quadratic punycode encoding of an overlong label before applying its length check, which can exhaust CPU. Paul Johnson reported the issue on oss-security, pointing to the MetaCPAN distribution and GitHub repository. The post does not report in-the-wild exploitation.
- Affects Net::IDN::UTS46 versions before 2.590.
- Overlong labels are encoded before the length check.
- Quadratic punycode work can exhaust CPU.
- Tracked as CVE-2026-87081 in Net-IDN-Encode.
- CVEs
- CVE-2026-87081
- Products
- Net-IDN-EncodeNet::IDN::UTS46
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87081 | CPU Exhaustion via Quadratic Punycode Encoding in Perl Net::IDN::UTS46 < 2.590 | 7.5 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode Net::IDN::UTS46...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.