Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label. The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected. A direct caller encoding att
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::IDN::Punycode versions before 2.590 contain a critical input validation flaw that allows malformed UTF-8 sequences to reach the punycode encoder without validation checks. When the XS backend processes UTF-8 flagged strings containing malformed bytes—such as those generated by Perl's :utf8 PerlIO layer—it mishandles the sequence length reporting, causing the encoder to hang, crash, or produce incorrect output. This vulnerability affects any Perl application that processes internationalized domain names (IDNs) or user-supplied Unicode input without pre-validating UTF-8 integrity, making it relevant to web servers, email systems, DNS utilities, and any software handling domain name processing.
While this CVE shows no direct MITRE ATT&CK technique mapping, Casky's 754 mapped security skills would detect attack patterns through input validation monitoring and exception handling analysis. A practitioner using Casky would identify suspicious activity through detection of repeated encoding failures, unexpected process crashes tied to domain name processing functions, or anomalous CPU/memory spikes during IDN handling—indicators pointing to CWE-835 (infinite loops) and CWE-1286 (improper validation of syntactic correctness of input). Extended reasoning across Casky's skill set would correlate these signals with other reconnaissance or exploitation attempts, revealing whether an attacker is probing for vulnerable Perl environments or attempting denial-of-service attacks against applications that normalize domain names.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-87082. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation