Net::Whois::Raw EUVD-2026-92267

Exploitation requires use of the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 - the Net::Whois::Raw library modules are NOT affected. The flaw only triggers for unicode (IDN) domain labels that fall outside what pwhois lowercases (ASCII and Cyrillic letters): specifically labels containing other uppercase letters, or labels not in NFC normalization form. Such a label is Punycode-encoded directly with 'xn--' prepended, skipping IDNA mapping/normalization, so it resolves to a different A-label than its correct IDNA form (e.g. U+00C9+'cole' → 'xn--cole-pka' instead of 'xn--cole-9oa'). Limiting factors: user interaction is required (the victim must actually query such a domain via the CLI), ASCII-only and already-correct IDN lookups are unaffected, and anything calling the library API directly is safe. No credentials or elevated privileges are involved.

This is a genuinely low-priority correctness/encoding flaw (CWE-176) rather than a classic exploitable code-execution issue. All signals align toward low real-world risk: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced (only the issue, PR, patch, and RFC references). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N = 5.4 Medium) requires user interaction and yields only Low confidentiality and Low integrity impact, consistent with a tool returning WHOIS data for the wrong domain rather than leaking secrets or executing code. One important caveat: the AV:N rating is debatable - the actual defect is in a locally-run command-line tool (pwhois), and the 'network' element is only that the resulting WHOIS lookup goes to a different domain; this is closer to local tool misuse than remote attack, so the network vector overstates reachability. The impact is realistic but narrow: an analyst or automated process relying on pwhois output could be fed WHOIS data for an attacker-chosen A-label (e.g. a pre-registered wrong-punycode domain), leading to incorrect trust or attribution decisions. No conflicting severity signals, but the SSVC-style verdict is 'track, not act now': low automatability, modest technical impact, no evidence of exploitation.

An attacker induces a victim (or an automated pipeline) to run pwhois against a unicode domain name containing an uppercase non-ASCII letter or a non-NFC label, for example a label of U+00C9 followed by 'cole'. Because pwhois skips IDNA mapping/normalization, it encodes to 'xn--cole-pka' instead of the correct 'xn--cole-9oa' and queries WHOIS for a different, attacker-controllable domain, returning misleading registrant/ownership data the victim then trusts. No public exploit code exists; exploitation is low-complexity but depends on the victim choosing to look up a crafted name.