Is CVE-2016-15059 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-15059 being exploited in the wild.

How severe is CVE-2016-15059?

Critical severity, with a CVSS score of 9.8, published 22 September 2026.

Which products and versions are affected?

CPAN Net::IDN::Punycode before 2.301.

Is there a fix for CVE-2016-15059?

A patch was published on 2016-12-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-15059 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-15059?

Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-15059: Net::IDN::Punycode heap buffer overflow in encode_punycode

CVE-2016-15059 · Severity: critical · CVSS 9.8 · Published 2026-09-22

Net::IDN::Punycode is a Perl library for encoding domain names using Punycode. The XS backend contains a heap buffer overflow vulnerability where certain inputs cause writes past the allocated output buffer, corrupting heap memory and potentially allowing code execution or denial of service.

Technologies: CPAN Net::IDN::Punycode. Vendors: CPAN.

Quick answers

Is CVE-2016-15059 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-15059 being exploited in the wild.
How severe is CVE-2016-15059?: Critical severity, with a CVSS score of 9.8, published 22 September 2026.
Which products and versions are affected?: CPAN Net::IDN::Punycode before 2.301.
Is there a fix for CVE-2016-15059?: A patch was published on 2016-12-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-15059 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-15059?: Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The XS implementation of encode_punycode allocates an output buffer based on input length but fails to check buffer bounds before writing the final digit of each encoding round and the terminating NUL byte. An attacker-controlled input string whose encoded form fills or exceeds the buffer causes unchecked writes past the allocated region. The pure Perl backend is unaffected; only code using the XS backend is vulnerable.

Affected products

CPAN Net::IDN::Punycode before 2.301

Timeline

2016-09-22: disclosed
2016-12-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.