CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
Perl Net::IDN::Punycode 2.302 before 2.590 leaks the output buffer on every rejected label.
CVE-2026-87078 affects Net::IDN::Punycode versions from 2.302 before 2.590 in the Perl Net-IDN-Encode distribution. decode_punycode leaks the output buffer on every rejected label, which can accumulate memory under repeated bad input. No in-the-wild exploitation is stated. Version 2.590 fixes the leak.
32