Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

Published 46 d ago 2026-09-22 · modified 45 d ago 2026-09-22 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 36%

Public exploits

none known

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode.

The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end.

Only the XS backend is affected.

Encoding an attacker-supplied string corrupts the heap.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 45 d ago 2026-09-22

Exploit prediction (EPSS)

0.42% probability of exploitation in the next 30 days, higher than 36% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Classification

Weakness

CWE-122 Heap-based Buffer Overflow

References

rt.cpan.org /Ticket/Display.html?id=118924 · issue-tracking
github.com /robrwo/Net-IDN-Encode/commit/9a3ba07f15d22c0347eefee9625b012cbc803657.patch · patch
metacpan.org /release/CFAERBER/Net-IDN-Encode-2.301/changes · release-notes
openwall.com /lists/oss-security/2026/09/22/10

Sources

CVE List: CVE-2016-15059
NVD: CVE-2016-15059

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.