Eight CVEs in Perl Net-IDN-Encode: memory corruption, leaks, CPU exhaustion and punycode decoding flaws in Net::IDN::Punycode, Punycode::PP and UTS46, all fixed in 2.590

Paul Johnson disclosed eight vulnerabilities on oss-security on 2026-09-22 in the Net-IDN-Encode Perl distribution — a heap buffer overflow (fixed in 2.301) plus seven further flaws including an out-of-bounds read, heap use-after-free, memory leak, two…

Between 15:41:09 and 15:56:55 UTC on 2026-09-22, Paul Johnson posted eight security disclosures to oss-security for modules in the Net-IDN-Encode Perl distribution. Four affect the encoding path: CVE-2016-15059, a heap buffer overflow via unchecked writes past the output buffer in encode_punycode, affecting Net::IDN::Punycode versions before 2.301 and fixed in 2.301; CVE-2026-74765, an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode, affecting versions before 2.590; CVE-2026-87082, where encode_punycode does not validate malformed UTF-8 and can hang, crash, or return an incorrect label, affecting versions before 2.590; and CVE-2026-87081, CPU exhaustion in Net::IDN::UTS46 versions before 2.590 because to_ascii performs quadratic punycode encoding of an overlong label before applying its length check. Four affect decoding: CVE-2026-74766, a heap use-after-free in decode_punycode triggered when a decoded code point reallocates the output buffer, affecting versions from 2.301 before 2.590; CVE-2026-87078, a leak of the output buffer on every rejected label in decode_punycode that can accumulate memory under repeated invalid input, affecting versions from 2.302 before 2.590; CVE-2026-87079, CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode, affecting versions before 2.590; and CVE-2026-87080, in which the pure-Perl Net::IDN::Punycode::PP versions before 2.590 decode a truncated label to a name containing a character it never encoded, which could enable IDN homograph-style spoofing in software relying on the module. Seven of the eight flaws are fixed in Net-IDN-Encode 2.590, which also supersedes the earlier 2.301 fix for CVE-2016-15059, so upgrading to 2.590 or later remediates all eight vulnerabilities. The differing affected-version ranges across the disclosures reflect the specific code changes each flaw depends on rather than any disagreement between sources. None of the eight disclosures mention exploitation in the wild.