Is CVE-2026-87082 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87082 being exploited in the wild.

How severe is CVE-2026-87082?

High severity, with a CVSS score of 7.5, published 22 September 2026.

Which products and versions are affected?

Perl CPAN Net::IDN::Punycode before 2.590.

Is there a fix for CVE-2026-87082?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87082 attacked?

It is attacked over the network.

Am I affected by CVE-2026-87082?

Check whether you run Perl CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87082: Perl Net::IDN::Punycode infinite loop and crash in encode_punycode

CVE-2026-87082 · Severity: high · CVSS 7.5 · Published 2026-09-22

Net::IDN::Punycode is a Perl library that converts domain names to Punycode format for internationalized DNS. When given malformed UTF-8 input, the encoder can hang indefinitely, crash with a memory error, or produce incorrect domain names. An application that directly calls the encode_punycode function with attacker-supplied bytes could be exploited to cause denial of service or data corruption.

Vendors: Perl CPAN.

Quick answers

Is CVE-2026-87082 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87082 being exploited in the wild.
How severe is CVE-2026-87082?: High severity, with a CVSS score of 7.5, published 22 September 2026.
Which products and versions are affected?: Perl CPAN Net::IDN::Punycode before 2.590.
Is there a fix for CVE-2026-87082?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87082 attacked?: It is attacked over the network.
Am I affected by CVE-2026-87082?: Check whether you run Perl CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in both the XS (C) and pure-Perl implementations of encode_punycode, which fail to validate UTF-8 input before processing. On Perl 5.32+, the XS backend's character decoder reports malformed sequences with length (STRLEN)-1, causing an infinite loop that scans backwards. On earlier Perl versions, the XS backend returns a valid Punycode label for a different domain name. The pure-Perl backend may abort with SIGBUS or crash with a panic. The documented conversion functions are not affected as they validate input against Unicode properties first; only direct calls to encode_punycode are vulnerable.

Affected products

Perl CPAN Net::IDN::Punycode before 2.590

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.