Quick answers
- Is CVE-2026-74765 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74765 being exploited in the wild.
- How severe is CVE-2026-74765?
- Medium severity, with a CVSS score of 6.5, published 22 September 2026.
- Which products and versions are affected?
- CPAN Net::IDN::Punycode before 2.590.
- Is there a fix for CVE-2026-74765?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-74765 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-74765?
- Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The XS backend stores the punycode delta and digit index in a signed int without overflow checks. The accumulation `delta += (m-n) * (h+1)` wraps on large code points, causing the digit index to exceed bounds. A negative or out-of-range index bypasses the bounds check (which only tests for values above 36), resulting in an out-of-bounds read from the digit table. Valid input such as 1927 ASCII letters followed by U+10FFFF can trigger the overflow, and the encoding function processes labels before checking their length.
Affected products
- CPAN Net::IDN::Punycode before 2.590
Timeline
- 2026-09-22: disclosed