CVE-2026-19954

Name	CVE-2026-19954
Description	Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150069

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libnet-whois-raw-perl (PTS)	bookworm, trixie	2.43-1.1	vulnerable
	forky, sid	2.99044-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libnet-whois-raw-perl	source	(unstable)	2.99043-2			1150069

Notes

[trixie] - libnet-whois-raw-perl <no-dsa> (Minor issue)
[bookworm] - libnet-whois-raw-perl <postponed> (Minor issue)
https://github.com/regru/Net-Whois-Raw/issues/34
https://github.com/regru/Net-Whois-Raw/pull/35
Fixed by: https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch
Fixed by: https://github.com/regru/Net-Whois-Raw/commit/3fae146789c8ea8c840e6d49eed89dbb41d4d640