CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode
Perl Net::IDN::Punycode before 2.590 can hang, crash, or mislabel malformed UTF-8.
40
Product
Net-IDN-Encode
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 22, 2026
- Last mentionedSep 22, 2026
Timeline
7 articles · newest firstCVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
Perl Net::IDN::UTS46 before 2.590 can exhaust CPU on overlong labels.
38
CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode
Perl Net::IDN::Punycode before 2.590 can exhaust CPU decoding a long Punycode label.
36
CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
Perl Net::IDN::Punycode 2.302 before 2.590 leaks the output buffer on every rejected label.
32
CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode
Perl Net::IDN::Punycode before 2.590 has a heap use-after-free when decode_punycode reallocates its buffer.
48
CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Perl Net::IDN::Punycode before 2.590 allows an out-of-bounds read via delta overflow in encode_punycode.
42
CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode
Perl Net::IDN::Punycode before 2.301 has a heap buffer overflow in encode_punycode, tracked as CVE-2016-15059.
24
Related CVEs
by mentions- Heap Buffer Overflow in Perl Net::IDN::Punycode XS Backend
- Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
- Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (high CVSS:3.1) (CVE-2026-74766) (Punycode 2.301 before 2.590)…
- CPU Exhaustion via Quadratic Punycode Encoding in Perl Net::IDN::UTS46 < 2.590
- DoS and Data Corruption in Perl Net::IDN::Punycode via Malformed UTF-8
- Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (CVE-2026-87079)
- Out-of-Bounds Read in Perl Net::IDN::Punycode XS Backend
Appears with
- Net::IDN::Punycodeproduct · 6
- Net::IDN::UTS46product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.