Is CVE-2026-87080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87080 being exploited in the wild.

How severe is CVE-2026-87080?

Critical severity, with a CVSS score of 9.1, published 22 September 2026.

Which products and versions are affected?

CPAN Net::IDN::Punycode::PP before 2.590.

Is there a fix for CVE-2026-87080?

A patch was published on 2026-08-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87080 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87080?

Check whether you run CPAN Net::IDN::Punycode::PP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87080: Net::IDN::Punycode::PP truncated label decoding vulnerability

CVE-2026-87080 · Severity: critical · CVSS 9.1 · Published 2026-09-22

Net::IDN::Punycode::PP is a Perl library that decodes internationalized domain names using the Punycode standard. A flaw in the pure-Perl decoder allows it to decode truncated labels that should be rejected, fabricating characters that the XS backend would not generate. This means different Perl installations could interpret the same encoded domain name differently, potentially allowing attackers to bypass validation or trigger inconsistent behavior across systems.

Vendors: CPAN.

Quick answers

Is CVE-2026-87080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87080 being exploited in the wild.
How severe is CVE-2026-87080?: Critical severity, with a CVSS score of 9.1, published 22 September 2026.
Which products and versions are affected?: CPAN Net::IDN::Punycode::PP before 2.590.
Is there a fix for CVE-2026-87080?: A patch was published on 2026-08-18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87080 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87080?: Check whether you run CPAN Net::IDN::Punycode::PP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The pure-Perl decoder uses four-argument substr to read input one character at a time and tests with defined() to detect end-of-input; however, substr on an exhausted string returns an empty string rather than undef, allowing decoding to continue past the end. The empty string is treated as digit value -22, which causes the decoder to fabricate an extra code point. The XS backend correctly rejects such truncated labels, creating a backend disagreement where approximately one-fifth of random punycode labels decode to different outputs depending on which backend is loaded.

Affected products

CPAN Net::IDN::Punycode::PP before 2.590

Timeline

2026-09-22: disclosed
2026-08-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.