{"id":"CVE-2026-19954","aliases":["DEBIAN-CVE-2026-19954","EUVD-2026-92267","GHSA-m543-jcgv-fpx5","MGASA-2026-0511","UBUNTU-CVE-2026-19954","openSUSE-SU-2026:12066-1"],"status":"published","title":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00229,"percentile":0.13818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-176"],"published":"2026-10-05T06:54:09Z","modified":"2026-10-17T12:58:46Z","fixes":[{"ecosystem":"Debian:14","package":"libnet-whois-raw-perl","fixed_in":["2.99043-2"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-Net-Whois-Raw","fixed_in":["2.990.420-1.1.mga10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-Whois-Raw","fixed_in":["2.99044-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1.1","2.99042-1","2.99043-1","2.99043-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1.1","2.99042-1","2.99043-1","2.99043-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.99043-2"}]}],"versions":["2.43-1.1","2.99042-1","2.99043-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Net-Whois-Raw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.990.420-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.99042-1","2.99043-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnet-whois-raw-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.43-1.1","2.99042-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Net-Whois-Raw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.99044-1.1"}]}]}],"references":[{"url":"https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes","tags":["release-notes","web"]},{"url":"https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch","tags":["patch"]},{"url":"https://github.com/regru/Net-Whois-Raw/issues/34","tags":["issue-tracking","report"]},{"url":"https://github.com/regru/Net-Whois-Raw/pull/35","tags":["issue-tracking"]},{"url":"https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING","tags":["web"]},{"url":"https://www.rfc-editor.org/rfc/rfc5891#section-5.2","tags":["technical-description","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19954"},{"url":"https://github.com/advisories/GHSA-m543-jcgv-fpx5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19954","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0511.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36461","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/05/9","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-19954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19954","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19954","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-19954","title":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T06:54:09.352Z","modified":"2026-10-06T17:52:09.371Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-176"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-92267","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T06:54:09Z","modified":"2026-10-06T17:52:09Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-m543-jcgv-fpx5","title":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries...","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T09:31:51Z","modified":"2026-10-06T18:31:27Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-176"],"updated_at":"2026-11-02T15:12:51.459076Z"}],"nvd":[{"id":"CVE-2026-19954","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T07:16:30.82Z","modified":"2026-10-06T18:16:53.823Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-176"],"updated_at":"2026-11-02T14:12:53.75133Z"}],"osv":[{"id":"DEBIAN-CVE-2026-19954","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.  pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".  The Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T07:16:30.82Z","modified":"2026-10-10T16:00:06.257496847Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-19954","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\". The Net::Whois::Raw library modules are not affected.","status":"published","published":"2026-10-05T07:16:00Z","modified":"2026-10-17T12:58:46.883541319Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"MGASA-2026-0511","title":"Updated perl-Net-Whois-Raw package fixes a security vulnerability","description":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois\ncommand-line tool that queries WHOIS for the wrong domain for unicode\ndomain names. (CVE-2026-19954)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.338120138Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12066-1","title":"perl-Net-Whois-Raw-2.99044-1.1 on GA media","description":"These are all security issues fixed in the perl-Net-Whois-Raw-2.99044-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.332768011Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}