CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87081

The Net::IDN::UTS46 Perl module (versions before 2.590 ) is vulnerable to CPU exhaustion due to quadratic punycode encoding of overlong labels within the to_ascii function. The encode_punycode function, following RFC 3492, performs an outer loop for each distinct non-ASCII code point while scanni...