CPU Exhaustion Vulnerability in Net::IDN::Punycode for Perl
CVE-2026-87079
What is CVE-2026-87079?
The Net::IDN::Punycode module for Perl suffers from a vulnerability that allows attackers to induce CPU exhaustion through inefficient processing. When decoding long labels in the decode_punycode function, the XS backend performs a quadratic number of scans for each decoded code point in a UTF-8 buffer. As a result, an attacker could exploit this inefficiency by passing excessively long labels, leading to resource exhaustion. The pure-Perl backend, while attempting to optimize this process, also retains a quadratic cost due to its input handling. This vulnerability is particularly concerning since there are no restrictions on the label length during conversion to Unicode, making systems susceptible to performance degradation from adversarial input.