CVE-2026-87079: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-87079 is a Denial of Service vulnerability in Net::IDN::Punycode (part of the Net-IDN-Encode Perl module) caused by quadratic CPU exhaustion when decoding long Punycode labels. It affects all versions before 2.590. Both the XS (C extension) and pure-Perl backends are vulnerable due to inefficient O(n²) algorithmic behavior during decode_punycode processing. The vulnerability was published on September 22, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-407 (Inefficient Algorithmic Complexity). In the XS backend, each decoded code point is inserted into a UTF-8 output buffer by scanning from the buffer's start one character at a time, resulting in O(n²) cost relative to label length — a 200,000-character label took over ten seconds in testing. The pure-Perl backend has an analogous flaw: it takes a working copy of the input before calling utf8::downgrade, so when the input carries the UTF-8 flag, every substr operation on the copy scans from the start with the same quadratic cost. Critically, the 63-byte DNS label length limit is only enforced during ASCII conversion (e.g., domain_to_ascii), not during Unicode conversion, so domain_to_unicode and uts46_to_unicode pass attacker-supplied labels of arbitrary length directly to the vulnerable decoder (GitHub Advisory, XS Patch, PP Patch).

Successful exploitation causes excessive CPU consumption on the affected server, leading to service unavailability (Denial of Service). There is no impact on confidentiality or data integrity. Any application that processes attacker-controlled domain names using Net::IDN::Punycode's domain_to_unicode or uts46_to_unicode functions is at risk, potentially affecting web servers, email systems, or any Perl-based service performing internationalized domain name (IDN) resolution (GitHub Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is network-exploitable with no authentication or user interaction required, and low attack complexity, making it straightforward to trigger once an attacker identifies a vulnerable application. The EPSS score is 0.0 and the CVE is not listed in the CISA KEV catalog. NVD SSVC assessment classifies exploitation as "none" and the attack as not fully automatable (GitHub Advisory).

1. Reconnaissance: Identify Perl-based applications that process user-supplied or externally sourced domain names using Net::IDN::Punycode versions before 2.590, particularly those exposing domain_to_unicode or uts46_to_unicode functionality.
2. Craft malicious input: Construct a Punycode-encoded domain label of extreme length (e.g., 200,000+ characters) that bypasses the 63-byte DNS limit check (which is only enforced during ASCII conversion, not Unicode conversion).
3. Submit the payload: Send the crafted domain name to the target application via any input vector that triggers IDN decoding — such as an HTTP request with a malicious Host header, a form field accepting domain names, or a DNS lookup interface.
4. Trigger CPU exhaustion: The decode_punycode function processes the oversized label with O(n²) complexity, consuming excessive CPU cycles and causing the application or server to become unresponsive or crash (GitHub Advisory, XS Patch).

• Network: Repeated requests containing abnormally long domain name labels (far exceeding 63 bytes) in HTTP Host headers, URL parameters, or DNS query fields targeting IDN-processing endpoints.
• Process: Sustained high CPU utilization by Perl interpreter processes (perl, application worker processes) without corresponding high I/O or memory activity; processes potentially hanging or timing out during domain name resolution.
• Logs: Application logs showing timeouts, unresponsive worker errors, or crashes correlated with requests containing unusually long internationalized domain name strings; alarm signal terminations in test environments.

Upgrade Net-IDN-Encode to version 2.590 or later, which fixes both the XS backend (by decoding into a code point array and converting to UTF-8 in a single pass) and the pure-Perl backend (by correctly downgrading the working copy $code rather than the original $input). If immediate patching is not possible, implement input validation to enforce a maximum domain label length (e.g., 63 bytes per DNS standards) before passing labels to the decoding functions, or apply rate limiting on domain name processing operations (GitHub Advisory, XS Patch, PP Patch).