CVE catalog

CVE-2026-19954

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using N

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.23% · Oct 25, 2026

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa". The Net::Whois::Raw library modules are not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibnet-whois-raw-perlsid2.99044-1fixed
Debianlibnet-whois-raw-perlforky2.99044-1fixed
Debianlibnet-whois-raw-perltrixie2.43-1.1vulnerable
Debianlibnet-whois-raw-perlbookworm2.43-1.1vulnerable
Opensuseperl-Net-Whois-Rawtumbleweed2.99044-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibnet-whois-raw-perlsourcesid2.99043-2not yet assignedNot reported[1150069]
Debianlibnet-whois-raw-perlsourceforky2.99043-2not yet assignedNot reported[1150069]
Debianlibnet-whois-raw-perlsourcetrixie(unfixed)not yet assignedNot reported[1150069]
Debianlibnet-whois-raw-perlsourcebookworm(unfixed)not yet assignedNot reported[1150069]
Opensuseperl-Net-Whois-Rawrpmtumbleweed2.99044-1.1Not reportedOPENSUSE-SU-2026:12066-1Not reported

[Debian bug #1150069]

Notes

[trixie] libnet-whois-raw-perl: Minor issue [bookworm] libnet-whois-raw-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnet-whois-raw-perl]Affected
    Details (2)

    • 2.43-1.1 · all · bookworm

      Affected

      nvd · libnet-whois-raw-perl · debian · bookworm; nvd · libnet-whois-raw-perl · debian · 12

    • 2.43-1.1 · all · bookworm

      Affected

      nvd · libnet-whois-raw-perl · debian · bookworm; nvd · libnet-whois-raw-perl · debian · 12

[Debian 13 (Trixie)]

  • [libnet-whois-raw-perl]Affected
    Details (2)

    • 2.43-1.1 · all · trixie

      Affected

      nvd · libnet-whois-raw-perl · debian · 13

    • 2.43-1.1 · all · trixie

      Affected

      nvd · libnet-whois-raw-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-Net-Whois-Raw]Affected

    Source package: [perl-Net-Whois-Raw]

    Details (1)

    • 2.99043-1.3 · noarch · tumbleweed

      Affected · Fixed: 2.99044-1.1

      nvd · perl-Net-Whois-Raw · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]