Bug 2545817 (CVE-2026-19954)

Summary: CVE-2026-19954 perl-net-whois-raw: perl-net-whois-raw: incorrect WHOIS domain lookup via improper Unicode normalization
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-net-whois-raw. The pwhois command-line tool skips standard Internationalizing Domain Names in Applications (IDNA) mapping and normalization steps when processing internationalized domain names. By supplying domain names containing specific Unicode characters, an attacker can cause the utility to query WHOIS records for the wrong domain, resulting in the retrieval of misleading or incorrect registration information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2546315    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-05 07:07:21 UTC 
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.

pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa".

The Net::Whois::Raw library modules are not affected.