CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii.
toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domaintoascii and emailtoascii, goes through toascii.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net-IDN-Encodeto a version that resolves this vulnerability.Fixed in 2.590-TRIAL
Event History
Frequently Asked Questions
What inputs are most likely to expose an application to this denial of service?
Applications are exposed when they convert attacker-controlled internationalized domain names or email addresses to ASCII using this distribution. The affected paths include to_ascii, domain_to_ascii, and email_to_ascii.
What does an attacker need to supply to trigger excessive CPU use?
The attacker needs to cause ASCII conversion of an overlong label containing distinct non-ASCII characters. Punycode encoding occurs before the 63-byte DNS label limit is enforced, and the encoding work grows quadratically with the label length.
How can I determine whether my deployment is affected?
Check whether the installed Net::IDN::UTS46 version is earlier than 2.590. Also identify code paths that pass untrusted domain or email input to the distribution's ASCII conversion functions.