CVE-2026-87080: CWE-1286 Improper Validation of Syntactic Correctness of Input
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
AI Analysis
Technical Summary
Net::IDN::Punycode::PP versions prior to 2.590 have an improper validation issue in the pure-Perl decoder. The decoder reads input one digit at a time using substr with four arguments and checks for the end of input by testing if the result is defined. However, substr on an exhausted string returns an empty string rather than undef, causing decoding to continue past the input end. This leads to an incorrect digit value that reduces the accumulator and results in an extra code point and position being derived. The XS backend correctly rejects such labels, causing inconsistent resolution behavior depending on which backend is used.
Potential Impact
The vulnerability causes inconsistent interpretation of certain truncated Punycode labels between different backends of Net::IDN::Punycode. This can lead to different name resolutions on systems using the pure-Perl backend versus the XS backend. This discrepancy may cause confusion or errors in applications relying on consistent domain name decoding but does not directly indicate code execution or data exposure.
Mitigation Recommendations
No official patch information is provided. Since the XS backend rejects the malformed labels, using the XS backend where possible mitigates the issue. Users should upgrade to version 2.590 or later once available to ensure consistent and correct decoding. Until then, avoid using the pure-Perl backend for decoding Punycode labels or validate inputs externally to prevent truncated labels.
CVE-2026-87080: CWE-1286 Improper Validation of Syntactic Correctness of Input
Description
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
CVSS v3.1
Score 9.1critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Net::IDN::Punycode::PP versions prior to 2.590 have an improper validation issue in the pure-Perl decoder. The decoder reads input one digit at a time using substr with four arguments and checks for the end of input by testing if the result is defined. However, substr on an exhausted string returns an empty string rather than undef, causing decoding to continue past the input end. This leads to an incorrect digit value that reduces the accumulator and results in an extra code point and position being derived. The XS backend correctly rejects such labels, causing inconsistent resolution behavior depending on which backend is used.
Potential Impact
The vulnerability causes inconsistent interpretation of certain truncated Punycode labels between different backends of Net::IDN::Punycode. This can lead to different name resolutions on systems using the pure-Perl backend versus the XS backend. This discrepancy may cause confusion or errors in applications relying on consistent domain name decoding but does not directly indicate code execution or data exposure.
Mitigation Recommendations
No official patch information is provided. Since the XS backend rejects the malformed labels, using the XS backend where possible mitigates the issue. Users should upgrade to version 2.590 or later once available to ensure consistent and correct decoding. Until then, avoid using the pure-Perl backend for decoding Punycode labels or validate inputs externally to prevent truncated labels.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-09-08T19:22:20.005Z
- State
- PUBLISHED
Threat ID: 6ab22f39f7a7c54106d716ae
Added to database: 09/22/2026, 07:33:13 UTC
Last enriched: 09/22/2026, 07:47:48 UTC
Last updated: 09/22/2026, 17:33:22 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.