CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode
Perl Net::IDN::Punycode before 2.590 has a heap use-after-free when decode_punycode reallocates its buffer.
CVE-2026-74766 is a heap use-after-free in Perl Net::IDN::Punycode versions from 2.301 before 2.590. In decode_punycode, a decoded code point that reallocates the output buffer can leave a dangling use of the old buffer. The oss-security post does not report active exploitation. The flaw is fixed in 2.590.
- Heap use-after-free in decode_punycode.
- Affects versions 2.301 before 2.590.
- A decoded code point reallocates the output buffer.
- Fixed in Net-IDN-Encode 2.590; exploitation not reported.
- CVEs
- CVE-2026-74766
- Products
- Net::IDN::PunycodeNet-IDN-Encode
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74766 | Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (high CVSS:3.1) (CVE-2026-74766) (Punycode 2.301 before 2.590)… | 8.4 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.