Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.
CVE-2026-19954
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-19954
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/regru/Net-Whois-Raw",
"modules": [
"Net::Whois::Raw"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.99044",
"versionType": "custom"
}
],
"packageURL": "pkg:cpan/Net-Whois-Raw",
"packageName": "Net-Whois-Raw",
"programFiles": [
"bin/pwhois"
],
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "to_punycode"
}
]
}
]- Related CVEs
- CVE-2026-19954
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #9493 · Revision 1
- Added to Heist Feed
- Publisher date