EUVD-2026-84294
GHSA-653x-rhrr-h9h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted domain or email to Perl app
-
ExploitOverlong non-ASCII label reaches to_ascii
-
ExecutionQuadratic punycode encoding runs before length check
-
ImpactCPU exhaustion stalls worker/service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitable when a Perl application passes attacker-controlled hostnames or email addresses into Net::IDN::UTS46 to_ascii or the wrappers domain_to_ascii / email_to_ascii (Net::IDN::Encode) for IDN normalization. The trigger is a single DNS label longer than 63 bytes composed of many distinct non-ASCII code points, which forces the RFC 3492 encoder into quadratic work before the length check rejects it. No authentication, user interaction, or non-default configuration is required (AV:N/PR:N/UI:N); the practical limiting factor is that the application must actually feed untrusted input through these normalization functions on a reachable code path, and versions before 2.590 must be installed. |
| Impact | This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) correctly scopes it as a network-reachable, unauthenticated, no-interaction denial-of-service with no confidentiality or integrity impact - the 'HIGH' rating comes entirely from A:H. Corroborating signals point away from urgency rather than toward it: EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and SSVC records Exploitation=none with Technical Impact=partial. The one signal that raises priority is SSVC Automatable=yes - the quadratic-complexity trigger is cheap and scriptable, so an attacker who can reach a vulnerable code path can reliably burn CPU. Net assessment: a real but not emergency-priority DoS; patch on a normal cadence unless the affected Perl code is on a hot untrusted-input path. Note a metadata conflict: the input Tag says 'Information Disclosure,' but the CVSS vector, CWE-407 (Algorithmic Complexity), and the description all describe CPU-exhaustion DoS with C:N - the tag is mislabeled and should not drive triage. |
| Exploit ScenarioDerived | An attacker submits a single overlong domain label or email address composed of many distinct non-ASCII code points to a Perl service that normalizes hostnames or emails via Net::IDN::UTS46 (e.g. through domain_to_ascii or email_to_ascii). Because to_ascii punycode-encodes the label before applying the 63-byte DNS length check, the RFC 3492 encoder does O(n²) work before rejecting the input, spiking CPU and stalling the worker. No public weaponized exploit is identified - the fix commit ships only regression tests (uts46_quadratic-pp/xs.t), not an attack tool - and exploitation needs no authentication or user interaction given AV:N/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
CPU exhaustion in Net::IDN::UTS46 before version 2.590 lets a single crafted overlong IDN label consume disproportionate CPU, because to_ascii punycode-encodes each label before applying the 63-byte DNS length check and the RFC 3492 encoder's outer loop runs once per distinct non-ASCII code point while rescanning the whole label each pass. Remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact A:H) who can reach Perl code that normalizes untrusted hostnames or email addresses through to_ascii, domain_to_ascii, or email_to_ascii can stall a request or worker with one input string. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.15% (5th percentile), so this is a genuine but bounded availability risk rather than a broadly exploited one.
RemediationAI
The primary fix is to upgrade to Net::IDN::Encode / Net::IDN::UTS46 2.590, which adds the pre-encoding length check; note that the MetaCPAN reference supplied is labelled a TRIAL release, so confirm a stable release of 2.590 (or later) is available in your CPAN mirror before deploying. The exact changes are visible in the upstream commits https://github.com/robrwo/Net-IDN-Encode/commit/5ac3315131264670efcd3a29857b651506dfee8e.patch and https://github.com/robrwo/Net-IDN-Encode/commit/ea34f812d7dc67f3b211f4d92e74c6a7e24d764a.patch. If upgrading is not immediately possible, apply an application-level guard that rejects any hostname label longer than 63 bytes (or an entire hostname beyond 253 bytes) before it reaches to_ascii, domain_to_ascii, email_to_ascii, or uts46_to_ascii; this is cheap and safe because such labels would be rejected anyway, though the trade-off is that naive length checks may reject some inputs on a different criterion than the library's UTS #46 validation and must be kept consistent with the 63-minus-IDNA-prefix boundary the patch uses. Additional compensating controls: wrap IDN normalization in a timeout or run it in a forked/out-of-process worker with alarm() so a quadratic input cannot pin a request handler - at the cost of some latency and complexity; and rate-limit or cap request body fields that carry hostnames and email addresses, which slows but does not eliminate repeated-trigger attempts. If your code calls Net::IDN::Punycode::encode_punycode directly, no version of that function limits its input, so enforce an explicit maximum label length in your own wrapper before calling it.
Affected ProductsAI
Net::IDN::UTS46 versions before 2.590, as shipped in the Net::IDN::Encode distribution, are affected on any platform running Perl; both the XS backend (Net::IDN::Punycode) and the pure-Perl fallback (Net::IDN::Punycode::PP) exhibit the quadratic behavior. The exposure surface extends to every ASCII conversion in the distribution that routes through to_ascii, explicitly including domain_to_ascii, email_to_ascii, and uts46_to_ascii, so applications performing IDN normalization of untrusted hostnames or email addresses are in scope, while Net::IDN::Punycode::encode_punycode called directly remains unbounded at any version unless the caller enforces its own limit. No CPE strings were supplied in the input data; the product identity is derived from the description, the CPANSec report, and the upstream repository commits. Version and changelog information is available at https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes, with the corresponding EUVD/NVD advisory entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87081.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected library implements UTS #46 / IDNA processing for Perl, converting Unicode labels to ASCII (A-label) form using the punycode algorithm of RFC 3492; CWE-407 (Inefficient Algorithmic Complexity) is the correct root-cause class, and the assessed vector carries C:N/I:N/A:H, i.e. denial of service with no confidentiality or integrity impact. In to_ascii the label is punycode-encoded first and only afterwards checked against the 63-byte DNS limit; because the RFC 3492 sample implementation's outer loop iterates once per distinct non-ASCII code point and rescans the entire input on every iteration, encoding cost grows quadratically with label length, so an overlong label of many distinct non-ASCII code points burns quadratic time before being rejected. Both backends are exposed: the XS (C) implementation and the pure-Perl Net::IDN::Punycode::PP fallback share the same algorithm, and the patch adds parallel regression tests (t/uts46_quadratic-xs.t and t/uts46_quadratic-pp.t) that fork a child, alarm(10), and feed a label built from every UTS #46-valid assigned code point in Unicode 10.0 repeated three times. The upstream fix in lib/Net/IDN/UTS46.pm short-circuits this in _process by croaking "label too long [A4_2]" when the label contains non-ASCII and length exceeds 63 minus the IDNA prefix length, since punycode never shortens a label. Notably, lib/Net/IDN/Punycode.pm changed only in documentation: encode_punycode still imposes no input length limit, so any code calling it directly with untrusted data remains exposed and must apply its own bound. One metadata inconsistency should be noted: the feed tag reads "Information Disclosure", which does not match the C:N/I:N/A:H vector or the CWE-407 root cause - the technical evidence supports denial of service only.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Untrusted input reaches the encoder over the network with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is pure CPU-exhaustion DoS so C:N/I:N/A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.
to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.
Executive ViewAI
Net::IDN::UTS46 versions before 2.590 can be forced to consume disproportionate CPU by a single crafted overlong IDN label, allowing unauthenticated remote attackers to stall Perl applications that normalize untrusted hostnames or email addresses. This creates a bounded availability risk for internet-facing or shared services using the affected library, and leadership should ensure affected deployments are patched because a vendor fix is available. No public exploit identified at time of analysis, so near-term response can focus on rapid inventory and remediation rather than incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB