Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-87080 is a critical vulnerability in Net::IDN::Punycode::PP versions before 2.590 that exploits a logic flaw in the pure-Perl punycode decoder. The vulnerability occurs because the decoder uses substr() to read input one digit at a time, relying on defined() to detect end-of-input. However, substr() returns an empty string (not undef) when exhausted, causing the decoder to continue processing past input boundaries. This results in decoding truncated labels into names containing characters that were never actually encoded, potentially allowing attackers to craft malicious internationalized domain names (IDNs) that bypass validation or trigger unexpected behavior in applications using this library. Organizations running Perl applications that depend on this library for domain name processing—particularly mail servers, DNS tools, and web applications handling international domains—face risks from domain spoofing, validation bypass, or denial of service attacks.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-87080. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation