CVE-2026-87078
Deferred Deferred - Pending Action

Memory Leak in Net::IDN::Punycode Perl Module

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: CPANSec

Description
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-23
AI Q&A
2026-09-22
EPSS Evaluated
2026-09-22
NVD
CVE-2026-87078
EUVD
EUVD-2026-84291

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-87078 is a memory leak vulnerability in the Net::IDN::Punycode Perl module's XS backend. The issue occurs because memory is allocated for results before input validation. When validation fails, the allocated memory is not freed, causing leaks. Attackers can exploit this by sending malformed input to grow process memory without bound.

Detection Guidance

Detecting this vulnerability requires monitoring memory usage in Perl applications using Net::IDN::Punycode. Check for processes consuming excessive memory after processing IDN (Internationalized Domain Name) inputs. Use system monitoring tools like top, htop, or ps to observe memory growth in Perl processes. Additionally, inspect application logs for repeated decoding failures or croak errors related to punycode processing.

Impact Analysis

An attacker could send specially crafted input to cause memory leaks. For example, 25,000 rejected decodes could leak around 100 MiB of memory. This could lead to denial-of-service conditions by exhausting system resources, degrading performance, or crashing applications using the vulnerable module.

Compliance Impact

This vulnerability primarily causes memory leaks in applications using the Net::IDN::Punycode module, which could lead to denial-of-service conditions due to excessive memory consumption. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than memory management issues.

Mitigation Strategies

Immediately update Net::IDN::Punycode to version 2.590 or later. If updating is not possible, disable the XS backend of the module if your application does not require it. Monitor memory usage of Perl processes handling IDN inputs and restrict untrusted input processing. Consider implementing rate limiting for IDN decoding requests to prevent memory exhaustion attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87078. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart