CVE-2026-87080: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-87080 is a Punycode decoding inconsistency vulnerability in Net::IDN::Punycode::PP (the pure-Perl backend of Net-IDN-Encode) that allows an unauthenticated attacker to craft truncated Punycode labels that resolve to different domain names depending on which backend implementation is in use. Affected versions are all releases of Net-IDN-Encode before 2.590. The vulnerability was published on September 22, 2026, with a patch available in version 2.590-TRIAL. It is classified as HIGH severity by Feedly's estimate; the EUVD lists a base score of 0.0 (not yet fully scored by NVD at time of publication) (GitHub Advisory, Feedly).

The root cause is improper validation of syntactic correctness of input (CWE-1286) in the decode_punycode function within lib/Net/IDN/Punycode/PP.pm. The pure-Perl decoder reads one digit at a time using four-argument substr and checks the result with defined to detect end-of-input; however, substr on an exhausted string returns an empty string ("") rather than undef, so the end-of-input guard never fires and decoding continues past the actual input boundary. The empty string is converted via ord to 0, which the digit-conversion logic maps to -22 — a value below every loop threshold — causing the decoder to treat the end-of-input as a completed code point and splice a fabricated character into the output. The fix (commit 48436c7) replaces the !defined $cp check with !length $cp, correctly detecting exhaustion (GitHub Patch, GitHub Advisory). The XS backend correctly rejects the same malformed labels, meaning the two backends can disagree on the decoded name for the same input.

An unauthenticated attacker can craft a truncated Punycode label that the pure-Perl backend resolves to a valid (but unintended) domain name while the XS backend rejects it entirely, enabling domain name spoofing. This inconsistency can be exploited to bypass security controls — such as allowlists, blocklists, or certificate validation logic — that rely on consistent domain name resolution across different Perl installations. Approximately one-fifth of random Punycode-alphabet labels are affected by this deterministic decoding error, broadening the attack surface (GitHub Patch, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication (Feedly). The EPSS score is 0.0, reflecting very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires no authentication and no user interaction, but exploitation is limited to scenarios where an attacker can influence domain name resolution in systems using the pure-Perl backend.

1. Identify target systems: Determine whether the target application uses Net::IDN::Punycode with the pure-Perl (PP) backend — i.e., systems where the XS extension did not build or is unavailable.
2. Craft a truncated Punycode label: Construct a Punycode-encoded label that is deliberately truncated mid-code-point (e.g., NMzZNlL6SU, abc-td, or z as demonstrated in the patch's test cases), which the PP backend will decode to a fabricated domain name.
3. Submit the crafted label: Send the malformed label to the target system in a context where domain name resolution or validation occurs (e.g., an email address, URL, or hostname field processed by Net::IDN::Encode).
4. Exploit the inconsistency: The PP backend resolves the truncated label to an unintended domain name (containing a fabricated code point), while an XS-based system would reject it — allowing the attacker to bypass domain-based security checks or cause the system to resolve to an attacker-controlled domain (GitHub Patch, GitHub Advisory).

• Logs: Application logs showing domain resolution of unexpected internationalized domain names (IDNs) that differ from expected values; errors or unexpected outputs from Net::IDN::Encode or Net::IDN::Punycode::PP in Perl application logs.
• Network: DNS queries for unexpected or malformed internationalized domain names originating from systems running Perl applications that use Net::IDN::Encode with the pure-Perl backend.
• Application Behavior: Security controls (allowlists, blocklists, certificate checks) being bypassed for domain names containing non-ASCII characters; inconsistent domain resolution results between different Perl installations processing the same Punycode label.

Upgrade Net::IDN::Encode (which includes Net::IDN::Punycode::PP) to version 2.590 or later, available on CPAN (MetaCPAN). As a secondary measure, ensure the XS backend is built and available on all Perl installations, as it correctly rejects the malformed labels. Review any security controls or domain validation logic that depends on consistent Punycode decoding across different Perl installations and add additional validation to enforce consistent name resolution behavior (GitHub Advisory, Feedly).