# CVE-2026-87082: Perl Net::IDN::Punycode infinite loop and crash in encode_punycode

Source: https://junglewise.ai/threats/cve-2026-87082-net-idn-punycode-versions-before-2-590-for-perl-hang-crash-or  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87082 · Severity: high · CVSS 7.5 · Published 2026-09-22

Net::IDN::Punycode is a Perl library that converts domain names to Punycode format for internationalized DNS. When given malformed UTF-8 input, the encoder can hang indefinitely, crash with a memory error, or produce incorrect domain names. An application that directly calls the encode_punycode function with attacker-supplied bytes could be exploited to cause denial of service or data corruption.

Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2026-87082 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87082 being exploited in the wild.

**How severe is CVE-2026-87082?** High severity, with a CVSS score of 7.5, published 22 September 2026.

**Which products and versions are affected?** Perl CPAN Net::IDN::Punycode before 2.590.

**Is there a fix for CVE-2026-87082?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87082 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-87082?** Check whether you run Perl CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in both the XS (C) and pure-Perl implementations of encode_punycode, which fail to validate UTF-8 input before processing. On Perl 5.32+, the XS backend's character decoder reports malformed sequences with length (STRLEN)-1, causing an infinite loop that scans backwards. On earlier Perl versions, the XS backend returns a valid Punycode label for a different domain name. The pure-Perl backend may abort with SIGBUS or crash with a panic. The documented conversion functions are not affected as they validate input against Unicode properties first; only direct calls to encode_punycode are vulnerable.

## Affected products

- Perl CPAN Net::IDN::Punycode before 2.590

## Timeline

- 2026-09-22: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/robrwo/Net-IDN-Encode/commit/0918fb4a951ed5f4494c4cf202419c2842507ea4.patch](https://github.com/robrwo/Net-IDN-Encode/commit/0918fb4a951ed5f4494c4cf202419c2842507ea4.patch)