CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Perl Net::IDN::Punycode before 2.590 allows an out-of-bounds read via delta overflow in encode_punycode.
CVE-2026-74765 affects Net::IDN::Punycode versions before 2.590 in Perl's Net-IDN-Encode. encode_punycode can perform an out-of-bounds read after an integer overflow of the delta accumulator. The disclosure does not claim observed exploitation. Upgrading to 2.590 addresses the bug.
- Out-of-bounds read in encode_punycode.
- Integer overflow of the delta accumulator is the cause.
- Affects versions before 2.590.
- Fixed in Net-IDN-Encode 2.590; no exploitation stated.
- CVEs
- CVE-2026-74765
- Products
- Net::IDN::PunycodeNet-IDN-Encode
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74765 | Out-of-Bounds Read in Perl Net::IDN::Punycode XS Backend | 6.5 | — |
From the original article
Posted by Paul Johnson on Sep 22 ======================================================================== https://metacpan. org/dist/Net-IDN-Encode https://github. com/robrwo/Net-IDN-Encode Net::IDN::Punycode...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.