Encoding Flaw in Net::IDN::Punycode for Perl Affects Error Handling

CVE-2026-87082

What is CVE-2026-87082?

The Net::IDN::Punycode module for Perl is susceptible to encoding issues due to inadequate validation of UTF-8 inputs. Unchecked malformed UTF-8 can lead to hangs or crashes when the encode_punycode function processes these inputs. Depending on the version of Perl, the XS backend may report malformed sequences improperly, causing the system to behave unpredictably—either crashing, aborting with a SIGBUS error, or returning incorrect labels. Vulnerable versions fail to properly match labels against Unicode properties, making direct calls to encode_punycode especially risky. It's crucial to ensure that systems utilizing this module are updated to eliminate these vulnerabilities.

References