{"schema":"threatline.record/2","record":{"id":"CVE-2026-19954","aliases":[],"summary":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names","details":"Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.\n\npwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by \"cole\" encodes to \"xn--cole-pka\" rather than \"xn--cole-9oa\".\n\nThe Net::Whois::Raw library modules are not affected.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19954","source_modified_at":"2026-10-06T17:52:09.371Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":null,"vendor":null,"versions":[{"lessThan":"2.99044","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19954","source_modified_at":"2026-10-06T17:52:09.371Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":null,"ecosystem":null},"version":"2.99044","basis":"first unaffected version stated in the CVE record"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00216,"percentile":0.11479,"score_date":"2026-10-23"},"published_at":"2026-10-05T06:54:09.352Z","modified_at":"2026-10-06T17:52:09.371Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-19954","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T17:52:09.371Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-19954","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes","tags":["release-notes"]},{"source":"CVE List","url":"https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch","tags":["patch"]},{"source":"CVE List","url":"https://github.com/regru/Net-Whois-Raw/issues/34","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/regru/Net-Whois-Raw/pull/35","tags":["issue-tracking"]},{"source":"CVE List","url":"https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING"},{"source":"CVE List","url":"https://www.rfc-editor.org/rfc/rfc5891#section-5.2","tags":["technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T17:52:04.047979Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T17:52:09.371Z","content_hash":"07dc7a0f6e76b6958199c6a256e334dd929d6014b1b2098fa061da57a89cd298"}}