CVE-2026-19954
Description
A flaw was found in perl-net-whois-raw. The pwhois command-line tool skips standard Internationalizing Domain Names in Applications (IDNA) mapping and normalization steps when processing internationalized domain names. By supplying domain names containing specific Unicode characters, an attacker can cause the utility to query WHOIS records for the wrong domain, resulting in the retrieval of misleading or incorrect registration information.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component. When the wrong encoding is used - even if closely related - the downstream component could decode the data incorrectly and misinterpret the output. This can have security consequences when the provided boundaries between control and data are inadvertently broken, because the resulting data could introduce control characters or special elements that were not sent by the product. The resulting data could then be used to bypass protection mechanisms such as input validation, and enable injection attacks.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
