Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::IDN::UTS46 before version 2.590 contains a denial-of-service vulnerability in its punycode encoding implementation. When processing domain names with internationalized characters, the to_ascii function performs quadratic-time encoding operations on overlong labels before enforcing DNS length restrictions. An attacker can craft malicious domain names containing many distinct non-ASCII characters that force the encoder's outer loop to iterate repeatedly while scanning the entire input label each time, causing severe CPU exhaustion. This affects any Perl-based systems using this library for IDN domain validation, including web servers, email systems, and DNS infrastructure that process user-supplied domain names without proper pre-validation.
While this CVE lacks mapped MITRE ATT&CK techniques and Casky currently has zero matching skills for detection, practitioners should monitor for Resource Exhaustion patterns (T1561 equivalent behaviors). Casky's Claude-powered analysis would identify attack indicators through extended reasoning: detecting repeated failed or slow to_ascii() processing calls, unusual CPU spikes during domain name validation, and patterns of requests containing internationalized domain labels with high concentrations of distinct Unicode characters. Security teams should look for log anomalies showing validation timeouts, thread pool saturation, or performance degradation during IDN processing—classic signs of algorithmic complexity exploitation. Immediate remediation involves upgrading Net::IDN::UTS46 to version 2.590+ and implementing input sanitization to reject suspiciously long labels before punycode encoding.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-87081. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation