Homepage

CVE-2026-19954 Affecting libnet-whois-raw-perl package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.22% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LIBNETWHOISRAWPERL-20511662
  • published5 Oct 2026
  • disclosed5 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 5 Oct 2026

NewCVE-2026-19954  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 libnet-whois-raw-perl.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libnet-whois-raw-perl package and not the libnet-whois-raw-perl package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.

pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa".

The Net::Whois::Raw library modules are not affected.