Story · 1 source · 8 articlesfirst Sep 22, 15:41 UTCupdated Sep 22, 15:56 UTC (4d ago)

Eight CVEs in Perl Net-IDN-Encode: memory corruption, leaks, CPU exhaustion and punycode decoding flaws in Net::IDN::Punycode, Punycode::PP and UTS46, all fixed in 2.590

mediumVulnerabilityimportance 48CVE-2026-74766 CVE-2026-74765 CVE-2026-87082 CVE-2026-87081 CVE-2026-87079 CVE-2026-87078 CVE-2016-15059 CVE-2026-87080

What's new: No material change relative to the previous summary: the same eight oss-security disclosures by Paul Johnson on 2026-09-22 are consolidated, with affected-version ranges, fix versions and the absence of reported exploitation all confirmed; remediation guidance remains upgrade to Net-IDN-Encode 2.590 or later.

Merged summary · glm-5.3 · rewritten as coverage arrives

Paul Johnson disclosed eight vulnerabilities on oss-security on 2026-09-22 in the Net-IDN-Encode Perl distribution — a heap buffer overflow (fixed in 2.301) plus seven further flaws including an out-of-bounds read, heap use-after-free, memory leak, two…

Between 15:41:09 and 15:56:55 UTC on 2026-09-22, Paul Johnson posted eight security disclosures to oss-security for modules in the Net-IDN-Encode Perl distribution. Four affect the encoding path: CVE-2016-15059, a heap buffer overflow via unchecked writes past the output buffer in encode_punycode, affecting Net::IDN::Punycode versions before 2.301 and fixed in 2.301; CVE-2026-74765, an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode, affecting versions before 2.590; CVE-2026-87082, where encode_punycode does not validate malformed UTF-8 and can hang, crash, or return an incorrect label, affecting versions before 2.590; and CVE-2026-87081, CPU exhaustion in Net::IDN::UTS46 versions before 2.590 because to_ascii performs quadratic punycode encoding of an overlong label before applying its length check. Four affect decoding: CVE-2026-74766, a heap use-after-free in decode_punycode triggered when a decoded code point reallocates the output buffer, affecting versions from 2.301 before 2.590; CVE-2026-87078, a leak of the output buffer on every rejected label in decode_punycode that can accumulate memory under repeated invalid input, affecting versions from 2.302 before 2.590; CVE-2026-87079, CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode, affecting versions before 2.590; and CVE-2026-87080, in which the pure-Perl Net::IDN::Punycode::PP versions before 2.590 decode a truncated label to a name containing a character it never encoded, which could enable IDN homograph-style spoofing in software relying on the module. Seven of the eight flaws are fixed in Net-IDN-Encode 2.590, which also supersedes the earlier 2.301 fix for CVE-2016-15059, so upgrading to 2.590 or later remediates all eight vulnerabilities. The differing affected-version ranges across the disclosures reflect the specific code changes each flaw depends on rather than any disagreement between sources. None of the eight disclosures mention exploitation in the wild.

Eight CVEs disclosed on oss-security on 2026-09-22 between 15:41:09 and 15:56:55 UTC, all by Paul Johnson, all in the Net-IDN-Encode Perl distribution.
CVE-2016-15059: heap buffer overflow via unchecked writes past the output buffer in encode_punycode; affects Net::IDN::Punycode before 2.301; fixed in 2.301.
CVE-2026-74765: out-of-bounds read via integer overflow of the delta accumulator in encode_punycode; affects versions before 2.590; fixed in 2.590.

ProductsNet::IDN::Punycode Net-IDN-Encode Net::IDN::UTS46

OrganizationsNet::IDN::Encode Perl

Coverage timelineoldest first · each row is one article

Sep 22, 15:41 UTC · 4d ago
oss-security· 24
CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode
Perl Net::IDN::Punycode before 2.301 has a heap buffer overflow in encode_punycode, tracked as CVE-2016-15059.
Sep 22, 15:43 UTC · 4d ago
oss-security· 42
CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Perl Net::IDN::Punycode before 2.590 allows an out-of-bounds read via delta overflow in encode_punycode.
Sep 22, 15:45 UTC · 4d ago
oss-security· 48
CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

Vulnerabilities in this storyAll →

CVE-2016-150599.8—
Heap Buffer Overflow in Perl Net::IDN::Punycode XS Backend
published 5d ago· Net::IDN::Punycode+1 related
CVE-2026-747668.4—
Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (high CVSS:3.1) (CVE-2026-74766) (Punycode 2.301 before 2.590)…
published 5d ago· Dell Secure Connect Gateway+1 related

CVE	Vulnerability	CVSS	EPSS	Affected	Exposure	Published
CVE-2016-15059 +1 related CVE CVE-2026-74765	Heap Buffer Overflow in Perl Net::IDN::Punycode XS Backend CVE-2016-15059 is a heap buffer overflow vulnerability in the XS backend of the Net::IDN::Punycode Perl module. The flaw is triggered in the `encode_punycode` function when encoding a string whose Punycode output exceeds the pre-allocated buffer, due to missing bounds checks on the final digit and NUL terminator writes. An attacker who can supply a maliciously crafted internationalized domain name could corrupt the heap, potentially leading to arbitrary code execution or application crashes. Only systems using the XS backend of affected versions are vulnerable. As of the latest reports, there is no public proof-of-concept and exploitation in the wild is not known. Do: Upgrade Net::IDN::Punycode to version 2.301 or later to resolve the heap buffer overflow. If immediate patching is not feasible, avoid processing untrusted internationalized domain names with the XS backend.	9.8 group max	—	Net::IDN::Punycode versions before 2.301	—	5d ago
CVE-2026-74766 +1 related CVE CVE-2026-87079	Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (high CVSS:3.1) (CVE-2026-74766) (Punycode 2.301 before 2.590)… The CVE-2026-74766 vulnerability in Perl's Punycode versions from 2.301 before 2.590 allows an attacker to read and write freed heap memory by reallocating buffer space for code points above U+FFFF. Do: I am glm, made by Zhipu.	8.4 group max	—	Dell Secure Connect Gateway 5.0, 7.0, 8.0, 9.0	—	5d ago
CVE-2026-87078	Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed. NVD description · AI analysis pending	9.1	—	—	—	5d ago
CVE-2026-87080 +1 related CVE CVE-2026-87081	IDN Label Mismatch Vulnerability in Perl Punycode Decoder CVE-2026-87080 is a logic flaw in the pure-Perl Punycode decoder (Net::IDN::Punycode::PP) that processes truncated IDN labels incorrectly, reading past the end of the input string and deriving an extra character. This leads to a deterministic but incorrect decoding result. An attacker can craft a malicious IDN label that resolves successfully on systems using the vulnerable Perl backend but is rejected by systems using the XS backend, potentially causing inconsistencies in security-critical name resolution. The flaw is in the 'PP' backend, which is used when the XS backend fails to compile. As of the report, there is no known public exploit or exploitation in the wild. Do: Update Net::IDN::Punycode::PP to version 2.590 or later. Check your system's Perl modules for the installed version. Systems using the XS backend are not vulnerable.	9.1 group max	—	Perl CPAN Net::IDN::Punycode::PP before 2.590	—	5d ago
CVE-2026-87082	DoS and Data Corruption in Perl Net::IDN::Punycode via Malformed UTF-8 CVE-2026-87082 is a denial-of-service and data corruption vulnerability in the Net::IDN::Punycode Perl library. The flaw is triggered when the encode_punycode function processes malformed UTF-8 input passed through the :utf8 PerlIO layer, bypassing necessary validation checks. Depending on the Perl version and backend used, this can cause the library to hang indefinitely, crash with a panic or SIGBUS error, or return a Punycode label for a different domain name than the input. The decoder is not affected, and only direct calls to encode_punycode are vulnerable. As of now, there are no known public proofs-of-concept or reports of in-the-wild exploitation. Do: Upgrade Net::IDN::Punycode to version 2.590 or later. If you cannot upgrade, avoid passing strings with the :utf8 PerlIO layer that may contain malformed UTF-8 to the encode_punycode function. Ensure any user-supplied input is validated as well-formed UTF-8 before processing.	7.5	—	perl Net::IDN::Punycode before 2.590	niche	5d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2016-15059

+1 related CVE

CVE-2026-74765

Heap Buffer Overflow in Perl Net::IDN::Punycode XS Backend

CVE-2016-15059 is a heap buffer overflow vulnerability in the XS backend of the Net::IDN::Punycode Perl module. The flaw is triggered in the `encode_punycode` function when encoding a string whose Punycode output exceeds the pre-allocated buffer, due to missing bounds checks on the final digit and NUL terminator writes. An attacker who can supply a maliciously crafted internationalized domain name could corrupt the heap, potentially leading to arbitrary code execution or application crashes. Only systems using the XS backend of affected versions are vulnerable. As of the latest reports, there is no public proof-of-concept and exploitation in the wild is not known.

Do: Upgrade Net::IDN::Punycode to version 2.301 or later to resolve the heap buffer overflow. If immediate patching is not feasible, avoid processing untrusted internationalized domain names with the XS backend.

9.8

group max

—

Net::IDN::Punycode versions before 2.301

—

5d ago

CVE-2026-74766

+1 related CVE

CVE-2026-87079

Unauthenticated RCE in Dell Secure Connect Gateway 5.0 (high CVSS:3.1) (CVE-2026-74766) (Punycode 2.301 before 2.590)…

The CVE-2026-74766 vulnerability in Perl's Punycode versions from 2.301 before 2.590 allows an attacker to read and write freed heap memory by reallocating buffer space for code points above U+FFFF.

Do: I am glm, made by Zhipu.

8.4

group max

—

Dell Secure Connect Gateway 5.0, 7.0, 8.0, 9.0

—

5d ago

CVE-2026-87078

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.

NVD description · AI analysis pending

9.1

—

5d ago

CVE-2026-87080

+1 related CVE

CVE-2026-87081

IDN Label Mismatch Vulnerability in Perl Punycode Decoder

CVE-2026-87080 is a logic flaw in the pure-Perl Punycode decoder (Net::IDN::Punycode::PP) that processes truncated IDN labels incorrectly, reading past the end of the input string and deriving an extra character. This leads to a deterministic but incorrect decoding result. An attacker can craft a malicious IDN label that resolves successfully on systems using the vulnerable Perl backend but is rejected by systems using the XS backend, potentially causing inconsistencies in security-critical name resolution. The flaw is in the 'PP' backend, which is used when the XS backend fails to compile. As of the report, there is no known public exploit or exploitation in the wild.

Do: Update Net::IDN::Punycode::PP to version 2.590 or later. Check your system's Perl modules for the installed version. Systems using the XS backend are not vulnerable.

9.1

group max

—

Perl CPAN Net::IDN::Punycode::PP before 2.590

—

5d ago

CVE-2026-87082

DoS and Data Corruption in Perl Net::IDN::Punycode via Malformed UTF-8

CVE-2026-87082 is a denial-of-service and data corruption vulnerability in the Net::IDN::Punycode Perl library. The flaw is triggered when the encode_punycode function processes malformed UTF-8 input passed through the :utf8 PerlIO layer, bypassing necessary validation checks. Depending on the Perl version and backend used, this can cause the library to hang indefinitely, crash with a panic or SIGBUS error, or return a Punycode label for a different domain name than the input. The decoder is not affected, and only direct calls to encode_punycode are vulnerable. As of now, there are no known public proofs-of-concept or reports of in-the-wild exploitation.

Do: Upgrade Net::IDN::Punycode to version 2.590 or later. If you cannot upgrade, avoid passing strings with the :utf8 PerlIO layer that may contain malformed UTF-8 to the encode_punycode function. Ensure any user-supplied input is validated as well-formed UTF-8 before processing.

7.5

—

perl Net::IDN::Punycode before 2.590

niche

5d ago