---
id: CVE-2026-19954
title: >-
  Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line
  tool that queries WHOIS for the wrong domain for unicode domain names.


  pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and
  prepends xn--
summary: >-
  Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line
  tool that queries WHOIS for the wrong domain for unicode domain names.


  pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and
  prepends xn--. …
severity: none
cwe:
  - CWE-176
product: Net-Whois-Raw
affected:
  - Net-Whois-Raw < 2.99044
published: '2026-10-05'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T07:16:30.820'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19954'
references:
  - url: 'https://github.com/regru/Net-Whois-Raw/issues/34'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://github.com/regru/Net-Whois-Raw/pull/35'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/NALOBIN/Net-Whois-Raw-2.99044/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/view/lib/Net/IDN/Punycode.pm#WARNING
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://www.rfc-editor.org/rfc/rfc5891#section-5.2'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-05T07:14:48.252Z'
---

## Overview

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names.

pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips the IDNA mapping and normalization steps, so a label with other uppercase letters, or not in NFC, encodes to a different A-label than its IDNA form. For example, a label of U+00C9 followed by "cole" encodes to "xn--cole-pka" rather than "xn--cole-9oa".

The Net::Whois::Raw library modules are not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.