CPU Exhaustion Vulnerability in Net::IDN::UTS46 for Perl

CVE-2026-87081

What is CVE-2026-87081?

The Net::IDN::UTS46 module in Perl is vulnerable to a denial-of-service (DoS) condition due to a CPU exhaustion flaw. Versions prior to 2.590 allow an attacker to exploit the quadratic nature of punycode encoding. This can occur when an excessively long label is processed before the necessary length checks are applied in the to_ascii function. The result is a significant increase in computational cost, wherein the processing time escalates in relation to the square of the number of distinct non-ASCII characters in the label. Users are encouraged to update to version 2.590 or later to mitigate this vulnerability effectively.

References