Punycode Buffer Leakage in Net::IDN::Punycode for Perl
CVE-2026-87078
Currently unrated
What is CVE-2026-87078?
The Net::IDN::Punycode module for Perl contains a flaw where versions prior to 2.590 can leak an output buffer during the decoding of Punycode labels. This occurs because, in the XS backend, buffers are allocated before validating input. If a rejected label is provided, memory remains allocated, potentially leading to memory bloat, as each failed attempt reserves space equal to twice the length of the invalid label without proper bounds checking. It is important for users to update to the latest version to remediate this issue.