Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character at a time. The scan runs once per code point over the output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same quadratic cost. Nothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any length to the decoder.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::IDN::Punycode versions before 2.590 contain a denial-of-service vulnerability in the punycode decoding function. When processing specially crafted international domain names, the decoder exhibits quadratic time complexity—each decoded character requires scanning the entire output buffer from the beginning to find the insertion point. This means a moderately long label can consume significant CPU resources, allowing remote attackers to exhaust server processing capacity with minimal bandwidth. The vulnerability affects any Perl-based applications that validate or process internationalized domain names, including mail servers, DNS resolvers, and web applications handling user-supplied domain inputs. While not yet actively exploited in the wild according to CISA records, this represents a classic algorithmic complexity vulnerability that requires minimal sophistication to trigger.
Although this CVE maps to CWE-407 (Inefficient Algorithmic Complexity) rather than specific MITRE ATT&CK techniques, Casky's extended reasoning capabilities would identify attack patterns consistent with Resource Exhaustion tactics. A practitioner using Casky would observe baseline anomalies: sustained high CPU utilization on domain processing functions without corresponding legitimate traffic spikes, repeated requests with increasingly longer punycode-encoded labels, or degraded service latency during periods of internationalized domain name resolution. The platform would correlate these behavioral signals with the known vulnerability pattern—quadratic insertion operations triggered by label length—enabling teams to distinguish legitimate internationalization traffic from deliberate exploitation attempts. Security teams should prioritize patching Net::IDN::Punycode to version 2.590 or later and implement rate limiting on punycode decoding operations as interim controls.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-87079. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation