CVE-2026-19954: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19954 is a vulnerability in the pwhois command-line tool shipped with Net::Whois::Raw versions before 2.99044 for Perl, in which unicode domain names are incorrectly encoded, causing WHOIS queries to be sent for the wrong domain. The tool uses Net::IDN::Punycode directly and prepends xn-- without performing the required IDNA mapping and normalization steps, resulting in a different ASCII-compatible encoding (A-label) than the correct IDNA form. For example, a label containing U+00C9 followed by "cole" encodes to xn--cole-pka instead of the correct xn--cole-9oa. The Net::Whois::Raw library modules themselves are not affected — only the pwhois CLI tool. It carries a CVSS v3.1 base score of 5.4 (Medium) and was disclosed on October 5, 2026 (Github Advisory, oss-security).

The root cause is classified under CWE-176 (Improper Handling of Unicode Encoding) and CWE-838 (Inappropriate Encoding for Output Context). The pwhois tool calls Net::IDN::Punycode directly to encode non-ASCII domain labels and manually prepends xn--, bypassing the IDNA processing pipeline defined in RFC 5891 — specifically the mapping (e.g., case folding beyond ASCII/Cyrillic) and NFC normalization steps. As a result, any unicode label containing non-ASCII uppercase characters outside the Cyrillic range, or labels not in NFC form, will produce an incorrect A-label and query a potentially different, attacker-registerable domain. The fix, implemented in PR #35, replaces the direct Net::IDN::Punycode call with Net::IDN::Encode::domain_to_ascii, which performs the full IDNA encoding pipeline (Github Issue, Github PR, oss-security).

Any user invoking the pwhois CLI tool with unicode domain names will receive WHOIS data for an incorrectly encoded domain rather than the intended one, leading to information confusion and lookup failures. There is a low confidentiality impact because a user may inadvertently receive registration data for an unintended domain, and a low integrity impact because the tool's output cannot be trusted for unicode inputs. An attacker could potentially register the incorrectly encoded domain (e.g., xn--cole-pka) to intercept or manipulate WHOIS lookup results for users querying the legitimate unicode domain (Github Advisory, oss-security).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.179–0.216%, placing it in a low exploitation probability range. Exploitation requires user interaction — specifically, a user must invoke pwhois with a unicode domain name — and the impact is limited to incorrect WHOIS query results rather than code execution (Github Advisory, oss-security).

Upgrade Net::Whois::Raw to version 2.99044 or later, which replaces the direct Net::IDN::Punycode call with Net::IDN::Encode::domain_to_ascii for correct IDNA encoding (Github PR, MetaCPAN). A patch file is also available at https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch for deployments that cannot immediately upgrade. As a workaround, pre-convert unicode domain names to their correct A-label form using Net::IDN::Encode::domain_to_ascii before passing them to pwhois, since the tool passes all-ASCII names through unchanged (oss-security).

The vulnerability was reported by Robert Rothenberg (robrwo) and disclosed via the CPAN Security Group to the oss-security mailing list on October 5, 2026 (oss-security). The maintainer (nalobin) responded promptly, merging the fix and releasing version 2.99044 on the same day the issue was filed (Github Issue). Red Hat tracked the issue as low severity in Bugzilla (Red Hat Bugzilla). Community reaction has been minimal given the limited scope of the vulnerability, which affects only the CLI tool and not the library modules.