CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

CVE-2016-15059 is a heap buffer overflow vulnerability in the XS backend of the Net::IDN::Punycode Perl module. The flaw is triggered in the `encode_punycode` function when encoding a string whose Punycode output exceeds the pre-allocated buffer, due to missing bounds checks on the final digit and NUL terminator writes. An attacker who can supply a maliciously crafted internationalized domain name could corrupt the heap, potentially leading to arbitrary code execution or application crashes. Only systems using the XS backend of affected versions are vulnerable. As of the latest reports, there is no public proof-of-concept and exploitation in the wild is not known.

Upgrade Net::IDN::Punycode to version 2.301 or later to resolve the heap buffer overflow. If immediate patching is not feasible, avoid processing untrusted internationalized domain names with the XS backend.