CVE-2016-15059
UnknownSummary
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.
Risk Assessment
An attacker can supply a string whose encoded form fills the buffer, causing heap corruption and potentially arbitrary code execution.
Recommendation
Update Net::IDN::Punycode to version 2.301 or later. Avoid encoding untrusted input until patched.
Other vulnerabilities in Net::IDN::Punycode
See all- CVE-2026-87082Unknown
Net::IDN::Punycode versions before 2.590 for Perl do not validate UTF-8 input in encode_punycode. A flagged string with malformed bytes can hang, crash, or return a wrong label. Only direct calls to encode_punycode are affected; the decoder is not vulnerable.
- CVE-2026-87079Unknown
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding long labels in decode_punycode. No label length limit exists in the to-Unicode direction, enabling CPU exhaustion attacks.
- CVE-2026-87078Unknown
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.
- CVE-2026-74766Unknown
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. Decoding an attacker-supplied punycode label reads and writes freed heap memory.
- CVE-2026-74765Unknown
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.
Original NVD description (English source)
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.