CVE-2026-87078 Details
Description
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.
A memory leak vulnerability has been identified in the XS backend of Net::IDN::Punycode, affecting versions 2.302 prior to 2.590. The issue arises in the decode_punycode function, where the output buffer is leaked for every rejected label. This occurs because the function allocates a scalar before validating the input, sizing the buffer at twice the input length. The allocated scalar is only released on successful execution, leaving memory allocated for each rejected label. As a result, processing invalid labels can lead to unbounded memory growth, with the process size increasing by twice the length of the rejected labels.
Users are advised to upgrade to Net::IDN::Punycode version 2.590-TRIAL or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/Net-IDN-Encode/commit/92572f726e48af5559de4cc8a831463b79dfb217.patch | CPANSec | Source CodeVendor |
| https://github.com/robrwo/Net-IDN-Encode/commit/edad63e0eeeeb18d93bc6dfe4d9dcdff9c244e1b.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/09/22/13 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Net::IDN::Punycode | >= 2.302, < 2.590 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CVE |
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | CPANSec |