CVE-2026-87080
📛 CVE Title
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
Description
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- CPANSec
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 9.1 / 10 CRITICAL source: NVD
- CWE(s)
-
CWE-1286 - Reserved
- 2026-09-08
- Published
- 2026-09-22 07:25 UTC
- Last updated
- 2026-09-22 17:07 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87080.json
- Linked Threat
- CVE-2026-87080 — Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-22 08:16:40 UTC
- NVD last modified
- 2026-09-22 19:07:00 UTC
- NVD CVSS v3.1
- 9.1 / 10 CRITICAL source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 5.2 / 10
- EPSS score
- 0.0015 (probability of exploitation in next 30 days)
- EPSS percentile
- 4.42% vs all CVEs — higher = more likely to be exploited, as of 2026-09-22
NVD / KEV / EPSS data refreshed 2026-09-23 02:35 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-84293 - Assigner
- CPANSec
- Published
- Sep 22, 2026, 7:25:03 AM
- Updated
- Sep 22, 2026, 5:07:30 PM
- EUVD base score (CVSS 3.1)
-
9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - EUVD-reported EPSS
- 0.1500
- Aliases
-
GHSA-m8c4-89qh-3j3f
ENISA description: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| — | — |
0 (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.openwall.com/lists/oss-security/2026/09/22/15 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/robrwo/Net-IDN-Encode/commit/48436c7ad2c4d4c6398110e11133754fc476a783.patch 9b29abf9-4ab0-4765-b253-1875cd9b441e
- https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes 9b29abf9-4ab0-4765-b253-1875cd9b441e
Remediations (18)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.qualys.com
The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services.
2026-09-23 15:42 UTC -
web:connect.tenable.com
On September 8, Microsoft released its September 2026 Patch Tuesday release which patched 964 CVEs with 104 rated critical and 860 rated as important. This update includes patches for two zero-days that were exploited in the wild.
2026-09-23 15:42 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-23 15:42 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-23 15:42 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-23 15:42 UTC -
web:senserva.com
The August 2026 Microsoft Patch Tuesday release (August 11, 2026 ): 67 updates fixing 751 CVEs , 4 actively exploited (CISA KEV). Ranked by real-world risk, free.
2026-09-23 15:42 UTC -
web:thecyberexpress.com
Microsoft's August 2026 Patch Tuesday fixes roughly 400 flaws, including three Zero-days, with one actively exploited and two publicly disclosed.
2026-09-23 15:42 UTC -
web:www.action1.com
In this issue: September 2026 Patch Tuesday updates from Microsoft, featuring zero-day vulnerabilities and critical security flaws.
2026-09-23 15:42 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-09-23 15:42 UTC -
web:www.rapid7.com
Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. Rapid7 has disclosed the second in a two-part critical remote execution vulnerability chain in SharePoint.
2026-09-23 15:42 UTC -
web:blog.qualys.com
Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...
2026-09-25 10:07 UTC -
web:blog.qualys.com
Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting its products. The security updates are packed with security fixes…
2026-09-25 10:07 UTC -
web:cyberscoop.com
Microsoft addressed 974 defects across its product suite, including two actively exploited zero-day vulnerabilities, in its monthly Patch Tuesday security program.
2026-09-25 10:07 UTC -
web:socprime.com
CVE - 2026 -85880 and CVE - 2026 -81963 Mitigation Microsoft released security updates addressing both actively exploited vulnerabilities on September 8, 2026 . Because exploitation has already been observed in the wild, organizations should prioritize these updates rather than treating them as part of the normal vulnerability management cycle.
2026-09-25 10:07 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-09-25 10:07 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 972 vulnerabilities, including two exploited zero-days and 113 critical, in its September 2026 Patch Tuesday rollout.
2026-09-25 10:07 UTC -
web:www.malwarebytes.com
Microsoft's August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges. The August update is smaller than July's record-breaking release, but it's still ...
2026-09-25 10:07 UTC -
web:www.securityweek.com
Microsoft on Tuesday rolled out a record number of patches, fixing 974 CVEs across its products, including two vulnerabilities exploited in the wild as zero-days. The first exploited zero-day, CVE - 2026 -85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that could allow a local attacker to gain System privileges. "An attacker who can execute code in a ...
2026-09-25 10:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-87080.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-87080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:22:56.999361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:23:02.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-22T17:07:30.035Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/22/15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Net::IDN::Punycode::PP"
],
"packageName": "Net-IDN-Encode",
"packageURL": "pkg:cpan/Net-IDN-Encode",
"programFiles": [
"lib/Net/IDN/Punycode/PP.pm"
],
"programRoutines": [
{
"name": "Net::IDN::Punycode::PP::decode_punycode"
}
],
"repo": "https://github.com/robrwo/Net-IDN-Encode",
"versions": [
{
"lessThan": "2.590",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.\n\nThe pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label.\n\nNet::IDN::Punycode uses this backend wherever the XS does not build.\n\nThe two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1286",
"description": "CWE-1286 Improper Validation of Syntactic Correctness of Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:25:03.236Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes"
},
{
"tags": [
"patch"
],
"url": "https://github.com/robrwo/Net-IDN-Encode/commit/48436c7ad2c4d4c6398110e11133754fc476a783.patch"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Net-IDN-Encode 2.590-TRIAL or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-87080",
"datePublished": "2026-09-22T07:25:03.236Z",
"dateReserved": "2026-09-08T19:22:20.005Z",
"dateUpdated": "2026-09-22T17:07:30.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}