Bug#1150069: libnet-whois-raw-perl: CVE-2026-19954

[Salvatore Bonaccorso]

Source: libnet-whois-raw-perl
Version: 2.99043-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for libnet-whois-raw-perl.

CVE-2026-19954[0]:
| Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois
| command-line tool that queries WHOIS for the wrong domain for
| unicode domain names.  pwhois encodes each non-ASCII label directly
| using Net::IDN::Punycode and prepends xn--. Apart from lowercasing
| ASCII and Cyrillic letters, it skips the IDNA mapping and
| normalization steps, so a label with other uppercase letters, or not
| in NFC, encodes to a different A-label than its IDNA form. For
| example, a label of U+00C9 followed by "cole" encodes to "xn--cole-
| pka" rather than "xn--cole-9oa".  The Net::Whois::Raw library
| modules are not affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19954
    https://www.cve.org/CVERecord?id=CVE-2026-19954
[1] https://github.com/regru/Net-Whois-Raw/issues/34
[2] https://github.com/regru/Net-Whois-Raw/pull/35
[3] https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore