CVE-2026-87079: CWE-407 Inefficient Algorithmic Complexity
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character at a time. The scan runs once per code point over the output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same quadratic cost. Nothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any length to the decoder.
AI Analysis
Technical Summary
CVE-2026-87079 describes an inefficient algorithmic complexity issue (CWE-407) in Net::IDN::Punycode versions prior to 2.590 for Perl. The decode_punycode function suffers from quadratic time complexity due to repeated scanning of the UTF-8 buffer for each code point insertion. The XS backend inserts decoded code points by scanning from the start of the buffer each time, and the pure-Perl backend also experiences quadratic cost when the input has the UTF-8 flag. The vulnerability is exacerbated because the 63-byte DNS label length limit is only enforced when converting to ASCII, not when converting to Unicode, allowing attacker-controlled labels of arbitrary length to be processed and cause CPU exhaustion.
Potential Impact
An attacker can exploit this vulnerability to cause excessive CPU consumption on systems using vulnerable versions of Net::IDN::Punycode when decoding maliciously crafted long labels. This can lead to denial of service conditions due to resource exhaustion. There is no indication of direct code execution or data corruption from the provided information.
Mitigation Recommendations
A fix is available in Net::IDN::Punycode version 2.590 and later. Users should upgrade to version 2.590 or newer to remediate this vulnerability. No other mitigation steps are indicated in the advisory.
CVE-2026-87079: CWE-407 Inefficient Algorithmic Complexity
Description
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character at a time. The scan runs once per code point over the output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same quadratic cost. Nothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any length to the decoder.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87079 describes an inefficient algorithmic complexity issue (CWE-407) in Net::IDN::Punycode versions prior to 2.590 for Perl. The decode_punycode function suffers from quadratic time complexity due to repeated scanning of the UTF-8 buffer for each code point insertion. The XS backend inserts decoded code points by scanning from the start of the buffer each time, and the pure-Perl backend also experiences quadratic cost when the input has the UTF-8 flag. The vulnerability is exacerbated because the 63-byte DNS label length limit is only enforced when converting to ASCII, not when converting to Unicode, allowing attacker-controlled labels of arbitrary length to be processed and cause CPU exhaustion.
Potential Impact
An attacker can exploit this vulnerability to cause excessive CPU consumption on systems using vulnerable versions of Net::IDN::Punycode when decoding maliciously crafted long labels. This can lead to denial of service conditions due to resource exhaustion. There is no indication of direct code execution or data corruption from the provided information.
Mitigation Recommendations
A fix is available in Net::IDN::Punycode version 2.590 and later. Users should upgrade to version 2.590 or newer to remediate this vulnerability. No other mitigation steps are indicated in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-09-08T19:22:20.005Z
- State
- PUBLISHED
Threat ID: 6ab22f39f7a7c54106d716ad
Added to database: 09/22/2026, 07:33:13 UTC
Last enriched: 09/22/2026, 07:47:53 UTC
Last updated: 09/22/2026, 14:25:44 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.