Perl (Organization): news timeline & CVEs

CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

Net::IDN::Punycode::PP Perl module before 2.590 decodes truncated punycode labels into names containing characters that were never encoded.

CVE-2026-87080 affects the pure-Perl punycode decoder in Net::IDN::Encode versions before 2.590. Truncated labels decode to names containing characters that were never encoded, which could enable IDN homograph-style spoofing in software relying on the module. The disclosure was posted to oss-security by Paul Johnson on September 22, 2026.

oss-securitySep 22, 15:52 UTC · 4d agoVulnerability 8 sources CVE-2026-87080

CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

Perl module Imager::File::PNG before 1.004 writes past the end of the row buffer when reading PNGs with a tRNS transparency chunk.

CVE-2026-73639 affects Imager::File::PNG versions 1.003 through before 1.004 for Perl. The flaw is a write past the end of the row buffer in read_direct8 when processing a PNG containing a tRNS transparency chunk. The bug was disclosed on the oss-security mailing list by Stig Palmquist, with the fix available in version 1.004.

oss-securitySep 17, 22:08 UTC · 9d agoVulnerability 2 sources CVE-2026-73639

CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd

Perl image library Imager before 1.035 reads outside the EXIF block via unchecked start offsets in tiff_load_ifd, fixed in 1.035.

CVE-2026-73638 affects Imager versions 0.45_02 through before 1.035 for Perl. The flaw is an out-of-bounds read outside the EXIF block caused by unchecked start offsets in the tiff_load_ifd function. It was disclosed on the oss-security mailing list by Stig Palmquist alongside CVE-2026-73639, with the fix available in version 1.035.

oss-securitySep 17, 22:06 UTC · 9d agoVulnerability 2 sources CVE-2026-73638

Perl

Timeline3 articles

Related CVEsby mentions

Appears with

CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode

CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd