Is CVE-2026-87081 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87081 being exploited in the wild.

How severe is CVE-2026-87081?

High severity, with a CVSS score of 7.5, published 22 September 2026.

Which products and versions are affected?

CPAN Net::IDN::UTS46 before 2.590.

Is there a fix for CVE-2026-87081?

A patch was published on 2026-09-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87081 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87081?

Check whether you run CPAN Net::IDN::UTS46 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87081: Net::IDN::UTS46 CPU exhaustion via quadratic punycode encoding

CVE-2026-87081 · Severity: high · CVSS 7.5 · Published 2026-09-22

Net::IDN::UTS46 is a Perl library that converts domain names to ASCII-compatible format (punycode). An attacker can submit domain names with very long labels containing many distinct non-ASCII characters, causing the library to consume CPU resources in quadratic proportion to label length before rejecting the input. This could slow down or halt systems that process untrusted domain names, such as email validators or DNS utilities.

Vendors: CPAN.

Quick answers

Is CVE-2026-87081 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87081 being exploited in the wild.
How severe is CVE-2026-87081?: High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?: CPAN Net::IDN::UTS46 before 2.590.
Is there a fix for CVE-2026-87081?: A patch was published on 2026-09-01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87081 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87081?: Check whether you run CPAN Net::IDN::UTS46 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The to_ascii function applies the 63-byte DNS limit only after punycode-encoding each label. The punycode encoder follows RFC 3492, whose algorithm runs in O(n²) time when labels contain many distinct non-ASCII code points. An overlong label of distinct Unicode characters triggers minutes of CPU consumption before the length check rejects it. The fix pre-checks label length before encoding.

Affected products

CPAN Net::IDN::UTS46 before 2.590

Timeline

2026-09-22: disclosed
2026-09-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.