CVE-2026-19954 regru CVE debrief

Who should care

Perl developers and administrators using Net::Whois::Raw pwhois for WHOIS queries should assess exposure and verify version 2.99044 or later is deployed. They should also monitor WHOIS queries for abnormal activity and review compensating controls for exposed systems.

Why it matters

CVE-2026-19954 affects Net::Whois::Raw pwhois command-line tool, causing incorrect WHOIS queries for unicode domain names. Defenders should assess exposure, verify version 2.99044 or later, and monitor WHOIS queries.

• Incorrect WHOIS queries may lead to inaccurate domain information retrieval
• Potential for increased latency or errors in WHOIS query results
• Need for verification of Net::Whois::Raw version 2.99044 or later deployment
• Possible impact on domain name resolution and validation processes

Technical summary

The Net::Whois::Raw pwhois command-line tool incorrectly queries WHOIS for unicode domain names due to improper encoding using Net::IDN::Punycode. This issue affects versions before 2.99044 for Perl. The library modules are not impacted. The problem arises from incorrect encoding of non-ASCII labels, skipping IDNA mapping and normalization steps, resulting in incorrect A-labels for certain domain names. Defenders should assess exposure and verify version 2.99044 or later is deployed. The CVE record was published on 2026-10-05T07:16:30.820Z and has not been modified since then.

Defensive priority

Assess exposure where Net::Whois::Raw pwhois is used, verify version 2.99044 or later is deployed, and monitor for abnormal WHOIS queries.

Recommended defensive actions

• Assess exposure where Net::Whois::Raw pwhois is used
• Verify version 2.99044 or later is deployed
• Monitor for abnormal WHOIS queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue arises from incorrect encoding of non-ASCII labels using Net::IDN::Punycode, skipping IDNA mapping and normalization steps. This results in incorrect A-labels for certain domain names. For example, a label of U+00C9 followed by 'cole' encodes to 'xn--cole-pka' rather than 'xn--cole-9oa'. The Net::Whois::Raw library modules are not affected. Evidence is limited to public CVE details and Net::Whois::Raw version 2.99044 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.