# CVE-2016-15059: Net::IDN::Punycode heap buffer overflow in encode_punycode

Source: https://junglewise.ai/threats/cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2016-15059 · Severity: critical · CVSS 9.8 · Published 2026-09-22

Net::IDN::Punycode is a Perl library for encoding domain names using Punycode. The XS backend contains a heap buffer overflow vulnerability where certain inputs cause writes past the allocated output buffer, corrupting heap memory and potentially allowing code execution or denial of service.

Technologies: [CPAN Net::IDN::Punycode](https://junglewise.ai/threats/technologies/net-idn-punycode). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2016-15059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-15059 being exploited in the wild.

**How severe is CVE-2016-15059?** Critical severity, with a CVSS score of 9.8, published 22 September 2026.

**Which products and versions are affected?** CPAN Net::IDN::Punycode before 2.301.

**Is there a fix for CVE-2016-15059?** A patch was published on 2016-12-03. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-15059 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-15059?** Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The XS implementation of encode_punycode allocates an output buffer based on input length but fails to check buffer bounds before writing the final digit of each encoding round and the terminating NUL byte. An attacker-controlled input string whose encoded form fills or exceeds the buffer causes unchecked writes past the allocated region. The pure Perl backend is unaffected; only code using the XS backend is vulnerable.

## Affected products

- CPAN Net::IDN::Punycode before 2.301

## Timeline

- 2016-09-22: disclosed
- 2016-12-03: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/robrwo/Net-IDN-Encode/commit/9a3ba07f15d22c0347eefee9625b012cbc803657.patch](https://github.com/robrwo/Net-IDN-Encode/commit/9a3ba07f15d22c0347eefee9625b012cbc803657.patch)

## Related threats

- [Net::IDN::Punycode CPU exhaustion via quadratic insertion cost](https://junglewise.ai/threats/cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu)
- [Net::IDN::Punycode memory leak in decode_punycode](https://junglewise.ai/threats/cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak)
- [Net::IDN::Punycode heap use-after-free in decode_punycode](https://junglewise.ai/threats/cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow)
- [Net::IDN::Punycode integer overflow in delta accumulator](https://junglewise.ai/threats/cve-2026-74765-net-idn-punycode-versions-before-2-590-for-perl-allow-an-out-of)