CVE-2026-87078

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-87078
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87078.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-87078
Downstream
Published
2026-09-22T07:19:33Z
Modified
2026-09-24T03:46:38Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
Details

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode.

The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII.

Only the XS backend is affected.

A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87078.json"
}
References

Affected packages

Git / github.com/robrwo/net-idn-encode

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/net-idn-encode
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b903cf0aeb82ff60e98e180a26daf3f9943f167
Fixed
92572f726e48af5559de4cc8a831463b79dfb217
Fixed
edad63e0eeeeb18d93bc6dfe4d9dcdff9c244e1b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.302"
        },
        {
            "fixed":  "2.590"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Net-IDN-Encode-0.*
Net-IDN-Encode-0.999_20100110
Net-IDN-Encode-0.99_20080914
Net-IDN-Encode-0.99_20080919
Net-IDN-Encode-0.99_20091216
Net-IDN-Encode-0.99_20091231
Net-IDN-Encode-1.*
Net-IDN-Encode-1.000
Net-IDN-Encode-1.999_20120107
Net-IDN-Encode-1.999_20120108
Net-IDN-Encode-2.*
Net-IDN-Encode-2.000
Net-IDN-Encode-2.000_20120110
Net-IDN-Encode-2.001
Net-IDN-Encode-2.002
Net-IDN-Encode-2.003
Net-IDN-Encode-2.003_2013122700
Net-IDN-Encode-2.003_2013122701
Net-IDN-Encode-2.003_2013880700
Net-IDN-Encode-2.003_2013881000
Net-IDN-Encode-2.005
Net-IDN-Encode-2.099_20131225
Net-IDN-Encode-2.099_20131226
Net-IDN-tools-0.*
Net-IDN-tools-0.99_20070912
v2.*
v2.501
v2.502

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87078.json"