CVE-2026-87079: Net::IDN::Punycode CPU Exhaustion Vulnerability

CVE-2026-87079 Overview

CVE-2026-87079 is a CPU exhaustion vulnerability in the Perl module Net::IDN::Punycode before version 2.590. The flaw allows a remote attacker to trigger quadratic algorithmic complexity when decoding a Punycode label of attacker-controlled length. Both the XS backend and the pure-Perl backend suffer from the same class of issue during decode_punycode. Because the to-Unicode direction does not enforce the 63-byte DNS label limit, callers such as domain_to_unicode and uts46_to_unicode pass unbounded input to the decoder. The result is denial of service against any Perl service that decodes untrusted internationalized domain names (IDNs).

Critical Impact
Remote, unauthenticated attackers can consume CPU resources on any Perl application that decodes internationalized domain names, degrading or halting service availability.

Affected Products

Net::IDN::Encode / Net::IDN::Punycode for Perl, versions prior to 2.590
Perl applications invoking decode_punycode, domain_to_unicode, or uts46_to_unicode on untrusted input
Both the XS backend (lib/Net/IDN/Punycode.xs) and the pure-Perl backend (lib/Net/IDN/Punycode/PP.pm)

Discovery Timeline

2026-09-22 - CVE CVE-2026-87079 published to NVD
2026-09-22 - Public discussion on the OpenWall OSS-Security list
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-87079

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw (CWE-407) in Punycode decoding. Punycode inserts each decoded code point at a computed position within an accumulating output buffer. In the vulnerable XS implementation, the decoder locates that insertion point by scanning the UTF-8 buffer from the start, one character at a time. The scan repeats once per code point, so total work grows with the square of the label length.

The pure-Perl backend has an equivalent defect. It calls utf8::downgrade so that substr can index the working string byte-wise, but the downgrade is applied to the wrong variable. When the input carries the UTF-8 flag, each substr on the working copy scans from the beginning, reproducing the same quadratic cost.

A long attacker-supplied label passed to domain_to_unicode or uts46_to_unicode reaches the decoder without length validation. The 63-byte DNS label limit is enforced only in the to-ASCII direction.

Root Cause

The root cause is a missing bound on label length in the to-Unicode code path combined with linear-time character insertion into a UTF-8 or UTF-8-flagged buffer. Repeated linear scans over the growing output produce O(n²) runtime.

Attack Vector

An attacker sends a crafted Punycode label of large size to any service that decodes IDNs using Net::IDN::Encode. Typical exposure includes email address parsers, URL normalizers, DNS tooling, and web front ends. No authentication or user interaction is required.

text

// XS backend patch — decode through a code point buffer (excerpt)
		const char *in_s, *in_p, *in_e, *skip_p;
-		char *re_s, *re_p, *re_e;
+		char *re_s, *re_p;
 		int first = 1;
-		STRLEN length_guess, len, h, u8;
+		STRLEN len, h, total;
+		UV *cp_s;
+		SV *cp_sv;

 	CODE:
 		in_s = in_p = SvPV(input, len);
 		in_e = in_s + len;
-		length_guess = len * 2;
-		if(length_guess < 256) length_guess = 256;
-		RETVAL = NEWSV('D',length_guess);
+		RETVAL = NEWSV('D', len + 1);
 		SvPOK_only(RETVAL);
-		re_s = re_p = SvPV_nolen(RETVAL);
-		re_e = re_s + SvLEN(RETVAL);
+
+		cp_sv = sv_2mortal(newSV((len + 1) * sizeof(UV)));
+		cp_s = (UV*)SvPVX(cp_sv);

Source: GitHub commit 00d723423b

text

# Pure-Perl backend patch — downgrade the copy the decode loop reads
-    utf8::downgrade($input);	## handling failure of downgrade is more expensive than
+    utf8::downgrade($code);	## handling failure of downgrade is more expensive than
 				## doing the above regexp w/ utf8 semantics
     while(length $code)

Source: GitHub commit 447c6b38ef5

Detection Methods for CVE-2026-87079

Indicators of Compromise

Sustained high CPU utilization in Perl worker processes handling IDN, email, or URL input.
HTTP, SMTP, or API requests containing Punycode labels (prefixed xn--) far longer than the 63-byte DNS limit.
Increased request latency or worker timeouts correlated with inbound domain or email parsing.

Detection Strategies

Inspect application and proxy logs for xn-- labels exceeding 63 bytes, and flag any that reach decode_punycode, domain_to_unicode, or uts46_to_unicode.
Instrument Perl services with per-request CPU accounting to catch requests whose decode time grows nonlinearly with input size.
Track installed CPAN module versions and alert on Net::IDN::Encode versions below 2.590.

Monitoring Recommendations

Alert on Perl processes that exceed baseline CPU time during IDN decoding paths.
Monitor upstream WAF or reverse proxy telemetry for oversized hostname or address-local-part fields.
Correlate spikes in 5xx or timeout responses with volumes of Punycode-encoded input.

How to Mitigate CVE-2026-87079

Immediate Actions Required

Upgrade Net::IDN::Encode to version 2.590 or later on all Perl systems.
Enforce the 63-byte DNS label limit on any user-supplied hostname before invoking decode_punycode.
Add per-request CPU and wall-clock limits to Perl workers that process untrusted domain input.

Patch Information

The upstream fix ships in Net-IDN-Encode-2.590. The XS backend patch in GitHub commit 00d723423b restructures the decoder to write into an intermediate code point buffer, eliminating the quadratic scan. The pure-Perl backend patch in GitHub commit 447c6b38ef5 calls utf8::downgrade on the working copy so substr remains byte-indexed. Release notes are available on the MetaCPAN release page.

Workarounds

Reject inbound hostnames or address labels longer than 63 bytes at the application boundary.
Wrap calls to domain_to_unicode and uts46_to_unicode with a timeout using alarm or a resource-limited process.
Deploy WAF rules that strip or block xn-- labels exceeding the DNS length limit before they reach Perl services.

bash

# Upgrade to the fixed release via cpanm
cpanm Net::IDN::Encode@2.590

# Verify installed version
perl -MNet::IDN::Encode -E 'say $Net::IDN::Encode::VERSION'