Answer in brief
CVE-2026-87081 records a High severity (CVSS 7.5) vulnerability in Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. The current sources do not mark it as known exploited. The current feed maps Net-IDN-Encode (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Net-IDN-Encode (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Net-IDN-Encodegeneric | >=0 <2.590 | 2.590 |
Published upstream
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 22, 2026
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.
Quoted source text, attributed separately from HOL analysis.