CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

UBUNTU-CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87081 Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87081

The Net::IDN::UTS46 Perl module (versions before 2.590 ) is vulnerable to CPU exhaustion due to quadratic punycode encoding of overlong labels within the to_ascii function. The encode_punycode function, following RFC 3492, performs an outer loop for each distinct non-ASCII code point while scanni...

PT-2026-96672

Name of the Vulnerable Software and Affected Versions Net::IDN::UTS46 versions prior to 2.590 Description An issue exists where CPU exhaustion can occur due to quadratic punycode encoding of an overlong label. This happens because the to ascii function performs punycode encoding on each label...

Linux Distros Unpatched Vulnerability : CVE-2026-87081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii...

CVE-2026-87081: Inefficient Algorithmic Complexity

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

SUSE SLED15 / SLES15 Security Update : perl-URI (SUSE-SU-2026:4046-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4046-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punyco...

CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...

CLEANSTART-2026-VO23255 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the metallb package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

openSUSE 16 Security Update : perl-URI (openSUSE-SU-2026:21773-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21773-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing...

Security update for perl-URI

This update for perl-URI fixes the following issue: CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

SUSE-SU-2026:4070-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

CLEANSTART-2026-PE88816 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the helm-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

SUSE-SU-2026:4046-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

Security update for perl-URI

This update for perl-URI fixes the following issue: CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

OPENSUSE-SU-2026:21773-1 Security update for perl-URI

This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886...

OESA-2026-3591 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...

OESA-2026-3590 perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in...