CVE-2026-87078

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.

• CWE-401

• https://github.com/robrwo/Net-IDN-Encode/commit/92572f726e48af5559de4cc8a831463b79dfb217.patch
• https://github.com/robrwo/Net-IDN-Encode/commit/edad63e0eeeeb18d93bc6dfe4d9dcdff9c244e1b.patch
• https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes
• https://www.openwall.com/lists/oss-security/2026/09/22/13

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-87071The Forminator Forms WordPress plugin before 1.57.2.1 does n…5.3
• CVE-2026-87072Tanium addressed an improper access controls vulnerability i…7.1
• CVE-2026-87073Tanium addressed an improper access controls vulnerability i…6.5
• CVE-2026-87074The Forminator Forms WordPress plugin before 1.57.2.1 does …3.7
• CVE-2026-87075Tanium addressed an improper access controls vulnerability i…8.1
• CVE-2026-87076Tanium addressed an information disclosure vulnerability in …6.5
• CVE-2026-87079Net::IDN::Punycode versions before 2.590 for Perl allow CPU …7.5
• CVE-2026-8708The Genzel breadcrumbs plugin for WordPress is vulnerable to…4.3
• CVE-2026-87080Net::IDN::Punycode::PP versions before 2.590 for Perl decode…9.1
• CVE-2026-87081Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exh…7.5
• CVE-2026-87082Net::IDN::Punycode versions before 2.590 for Perl hang, cras…7.5
• CVE-2026-87083A weakness has been identified in tile-ai tilelang up to 0.1…5.5