CVE-2026-87082: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-87082 is a malformed UTF-8 input validation vulnerability in Net::IDN::Punycode (part of the Net-IDN-Encode Perl module) that causes the encode_punycode function to hang indefinitely, crash, or return an incorrect punycode label when processing attacker-supplied malformed UTF-8 bytes. All versions of Net-IDN-Encode before 2.590 are affected. The vulnerability was published on September 22, 2026, with a patch available in version 2.590 (Github Advisory). The CVSS score has not been formally assigned; the EPSS score is 0.0 and the severity is estimated as Medium (Feedly).

The root cause is improper validation of syntactic correctness of input (CWE-1286) combined with a loop with an unreachable exit condition (CWE-835). Neither the XS (C extension) nor the pure-Perl backend of encode_punycode validates that its input is well-formed UTF-8 before processing. When a string with Perl's UTF-8 flag set is passed over malformed bytes (as the :utf8 PerlIO layer can produce), the XS backend on Perl 5.32+ calls utf8_to_uvchr_buf, which returns a length of (STRLEN)-1 for malformed sequences, causing the scan cursor to step backward instead of forward, resulting in an infinite loop. On earlier Perl versions, the XS backend silently returns a label for a different name, while the pure-Perl backend may abort with SIGBUS (Perl 5.28+), die with a panic, or return a wrong label. A secondary issue was that utf8_to_uvchr_buf only reports malformed UTF-8 when utf8 warnings are enabled in the caller; the fix switches to utf8n_to_uvchr with UTF8_CHECK_ONLY to enforce validation regardless of warning state (Github Commit 1, Github Commit 2, Github Commit 3). Only direct calls to encode_punycode are affected; the documented higher-level conversion functions perform Unicode property validation that prevents malformed input from reaching the vulnerable encoder, and the decoder is not affected (Github Advisory).

Successful exploitation allows an attacker who can supply input to a direct caller of encode_punycode to cause a denial of service by hanging the Perl process indefinitely (on Perl 5.32+), crashing it with SIGBUS or a panic (on earlier Perl versions), or causing the function to silently return an incorrect punycode label corresponding to a different domain name than the one provided. The incorrect label output introduces an integrity risk in applications that rely on punycode encoding for domain name resolution or validation, potentially enabling domain confusion or bypass of security controls. The vulnerability's impact is limited to applications that directly invoke encode_punycode with untrusted input, rather than using the module's higher-level API (Github Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to supply attacker-controlled bytes to a direct call of encode_punycode, which is a narrower attack surface than the module's documented higher-level API (Github Advisory, Feedly).

1. Identify a vulnerable target: Find a Perl application using Net-IDN-Encode versions before 2.590 that directly calls Net::IDN::Punycode::encode_punycode with user-supplied input (rather than the higher-level to_ascii/to_unicode functions).
2. Craft malformed UTF-8 input: Prepare a byte string with the Perl UTF-8 flag set over malformed bytes, such as a truncated UTF-8 sequence (e.g., "abc\xE2\x82") or a byte that starts no valid UTF-8 sequence (e.g., "abc\xFF"). This can be achieved by passing raw bytes through a :utf8 PerlIO layer or using Encode::_utf8_on.
3. Submit the malformed input: Deliver the crafted string to the application's input vector that reaches the encode_punycode call (e.g., a domain name field in a web form, API parameter, or file input).
4. Trigger the vulnerability: On Perl 5.32+, the XS backend enters an infinite loop, hanging the process. On earlier Perl versions, the process crashes with SIGBUS or a panic, or returns an incorrect punycode label.
5. Achieve denial of service or label confusion: The application becomes unresponsive (infinite loop) or crashes, or processes a domain name that was never provided by the attacker, potentially bypassing domain-based security checks (Github Advisory, Github Commit 1).

• Process: Perl processes consuming 100% CPU indefinitely without completing, particularly those associated with applications performing domain name encoding or IDN processing.
• Logs: Application error logs showing SIGBUS signals, Perl panic messages, or unexpected process termination in components handling internationalized domain names.
• Logs: Perl runtime warnings or errors referencing encode_punycode or malformed UTF-8 sequences in application logs.
• Application Behavior: Domain name encoding returning unexpected or incorrect punycode labels that do not correspond to the input provided, potentially observable in DNS query logs or application audit trails.

Upgrade Net-IDN-Encode to version 2.590 or later, which adds UTF-8 validity checks in both the XS and pure-Perl backends of encode_punycode (Github Advisory, MetaCPAN). As a temporary workaround if immediate patching is not possible, avoid direct calls to encode_punycode with untrusted input and instead use the module's documented higher-level conversion functions (e.g., to_ascii), which perform Unicode property validation that prevents malformed UTF-8 from reaching the vulnerable encoder. Additionally, validate that all input strings are well-formed UTF-8 (e.g., using utf8::valid()) before passing them to encode_punycode.