CVE-2026-87081
Received Received - Intake

CPU Exhaustion in Net::IDN::UTS46 Perl Module

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-87081
EUVD
EUVD-2026-84294

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Net::IDN::UTS46 versions before 2.590 for Perl allows CPU exhaustion through quadratic punycode encoding of overlong labels. The encoding process checks label length only after encoding, causing excessive CPU usage for long labels with distinct non-ASCII characters.

Detection Guidance

Detecting this vulnerability requires checking for excessive CPU usage during IDN/Punycode encoding operations. Monitor system processes for unusually high CPU consumption by Perl scripts handling domain names. Use commands like 'top -c' or 'htop' to identify Perl processes consuming abnormal CPU time. Check logs for repeated encoding attempts on long Unicode labels.

Impact Analysis

An attacker could exploit this by sending specially crafted domain names or email addresses with very long labels. This would cause high CPU usage on servers processing these inputs, potentially leading to denial-of-service conditions.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks that disrupt services handling personal or sensitive data. CPU exhaustion from processing overlong labels may cause system unavailability, potentially violating availability requirements in these regulations.

Mitigation Strategies

Update Net::IDN::UTS46 to version 2.590 or later. If using Perl modules, run 'cpan upgrade Net::IDN::UTS46'. For systems using the library, apply the patches from the provided GitHub commits. Implement input validation to reject overlong labels before encoding. Monitor network traffic for suspicious domain encoding attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart