CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii

Net::IDN::UTS46, a Perl library implementing IDNA/UTS #46 domain-name processing, performs punycode encoding of a DNS label before enforcing the 63-byte length limit in its to_ascii function. The encoding follows the RFC 3492 sample implementation, whose cost grows with the square of a label's length when the label contains many distinct non-ASCII code points, so a single crafted overlong label can consume excessive CPU before being rejected. An attacker triggers this by supplying a hostile hostname or email address to any application that passes untrusted input through to_ascii, domain_to_ascii, or email_to_ascii (all ASCII-conversion entry points in the distribution use to_ascii). The impact is denial of service — CPU exhaustion on the process or worker handling the request — with no data exposure or code execution. No public proof of concept is known, the issue is not in the CISA KEV catalog, and no exploitation has been reported.