Net::IDN::Punycode (Product): news timeline & CVEs

CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode

Perl Net::IDN::Punycode before 2.590 can hang, crash, or mislabel malformed UTF-8.

Paul Johnson disclosed CVE-2026-87082 in Net::IDN::Punycode, part of the Perl Net-IDN-Encode distribution, affecting versions before 2.590. The encode_punycode function does not validate malformed UTF-8 and can hang, crash, or return an incorrect label. The report was posted to oss-security with links to the MetaCPAN distribution and the robrwo/Net-IDN-Encode repository. No exploitation is described.

oss-securitySep 22, 15:56 UTC · 4d agoVulnerability 8 sources CVE-2026-87082

CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode

Perl Net::IDN::Punycode before 2.590 can exhaust CPU decoding a long Punycode label.

Paul Johnson disclosed CVE-2026-87079 in Perl's Net::IDN::Punycode, part of Net-IDN-Encode. Versions before 2.590 can exhaust CPU because decode_punycode pays a quadratic insertion cost when decoding a long label. The issue is a denial-of-service flaw; no exploitation in the wild is reported. It is fixed in 2.590.

oss-securitySep 22, 15:50 UTC · 4d agoVulnerability 8 sources CVE-2026-87079

CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode

Perl Net::IDN::Punycode 2.302 before 2.590 leaks the output buffer on every rejected label.

CVE-2026-87078 affects Net::IDN::Punycode versions from 2.302 before 2.590 in the Perl Net-IDN-Encode distribution. decode_punycode leaks the output buffer on every rejected label, which can accumulate memory under repeated bad input. No in-the-wild exploitation is stated. Version 2.590 fixes the leak.

oss-securitySep 22, 15:47 UTC · 4d agoVulnerability 8 sources CVE-2026-87078

CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

Perl Net::IDN::Punycode before 2.590 has a heap use-after-free when decode_punycode reallocates its buffer.

CVE-2026-74766 is a heap use-after-free in Perl Net::IDN::Punycode versions from 2.301 before 2.590. In decode_punycode, a decoded code point that reallocates the output buffer can leave a dangling use of the old buffer. The oss-security post does not report active exploitation. The flaw is fixed in 2.590.

oss-securityupdated Sep 22, 15:56 UTC · 4d agofirst Sep 22, 15:45 UTC · 4d agoVulnerability 8 sources CVE-2026-74766

CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode

Perl Net::IDN::Punycode before 2.590 allows an out-of-bounds read via delta overflow in encode_punycode.

CVE-2026-74765 affects Net::IDN::Punycode versions before 2.590 in Perl's Net-IDN-Encode. encode_punycode can perform an out-of-bounds read after an integer overflow of the delta accumulator. The disclosure does not claim observed exploitation. Upgrading to 2.590 addresses the bug.

oss-securityupdated Sep 22, 15:56 UTC · 4d agofirst Sep 22, 15:43 UTC · 4d agoVulnerability 8 sources CVE-2026-74765

CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

Perl Net::IDN::Punycode before 2.301 has a heap buffer overflow in encode_punycode, tracked as CVE-2016-15059.

Paul Johnson reported on oss-security that Perl Net::IDN::Punycode before version 2.301 is affected by CVE-2016-15059. The bug is a heap buffer overflow from unchecked writes past the output buffer in encode_punycode, in the Net-IDN-Encode distribution. The notice does not report exploitation in the wild.

oss-securityupdated Sep 22, 15:56 UTC · 4d agofirst Sep 22, 15:41 UTC · 4d agoVulnerability 8 sources CVE-2016-150591

Net::IDN::Punycode

Timeline6 articles

Related CVEsby mentions

Appears with