CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
Perl Net::IDN::Punycode 2.302 before 2.590 leaks the output buffer on every rejected label.
CVE-2026-87078 affects Net::IDN::Punycode versions from 2.302 before 2.590 in the Perl Net-IDN-Encode distribution. decode_punycode leaks the output buffer on every rejected label, which can accumulate memory under repeated bad input. No in-the-wild exploitation is stated. Version 2.590 fixes the leak.
- Affects versions 2.302 through before 2.590.
- decode_punycode leaks the output buffer on rejected labels.
- Memory leak can grow under repeated invalid input.
- Fixed in Net-IDN-Encode 2.590.
- CVEs
- CVE-2026-87078
- Products
- Net::IDN::PunycodeNet-IDN-Encode
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87078 | Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode | 9.1 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.