CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode

CVE-2026-74765 is an integer overflow leading to an out-of-bounds read vulnerability in the XS backend of the Net::IDN::Punycode Perl module. The flaw is triggered when encoding a sufficiently long or specially crafted Punycode label, causing the delta accumulator to overflow and bypass an array bounds check, allowing a read from outside the intended digit table. A successful attack could crash the affected process or potentially leak memory contents. The vulnerability is currently assigned a CVSS v3.1 base score of 6.5 (Medium). No public proof-of-concept or known in-the-wild exploitation has been reported.

Do: Update the Net::IDN::Punycode Perl module to version 2.590 or later, which contains the fix for this vulnerability. Review any Perl applications using this library to ensure they are patched.