CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode
Perl Net::IDN::Punycode before 2.590 can exhaust CPU decoding a long Punycode label.
Paul Johnson disclosed CVE-2026-87079 in Perl's Net::IDN::Punycode, part of Net-IDN-Encode. Versions before 2.590 can exhaust CPU because decode_punycode pays a quadratic insertion cost when decoding a long label. The issue is a denial-of-service flaw; no exploitation in the wild is reported. It is fixed in 2.590.
- Affects Net::IDN::Punycode before 2.590.
- Quadratic insertion cost in decode_punycode can exhaust CPU.
- Triggered by decoding a long label.
- Fixed in version 2.590 of Net-IDN-Encode.
- CVEs
- CVE-2026-87079
- Products
- Net::IDN::PunycodeNet-IDN-Encode
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87079 | Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (CVE-2026-87079) | 7.5 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode Net::IDN::Punycode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.