# CVE-2026-74766: Net::IDN::Punycode heap use-after-free in decode_punycode

Source: https://junglewise.ai/threats/cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-74766 · Severity: high · CVSS 8.4 · Published 2026-09-22

Net::IDN::Punycode is a Perl library that decodes internationalized domain names. Versions 2.301 through 2.589 contain a memory safety bug in the C-based XS decoder that allows an attacker to read and write freed heap memory by crafting a malicious punycode-encoded domain label. An attacker could exploit this to cause crashes, information disclosure, or potentially arbitrary code execution.

Technologies: [CPAN Net::IDN::Punycode](https://junglewise.ai/threats/technologies/net-idn-punycode). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-74766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-74766 being exploited in the wild.

**How severe is CVE-2026-74766?** High severity, with a CVSS score of 8.4, published 22 September 2026.

**Which products and versions are affected?** CPAN Net::IDN::Punycode 2.301 through 2.589.

**Is there a fix for CVE-2026-74766?** A patch was published on 2026-08-17: Fix committed upstream in Net-IDN-Encode repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-74766 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-74766?** Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The XS backend's decode_punycode function computes an insertion pointer into the output buffer before growing the buffer to accommodate new bytes. When the buffer is reallocated during growth, all internal pointers are updated except the insertion pointer, which remains stale. Subsequent memory operations use the freed pointer. The vulnerability is triggered when decoding code points above U+FFFF (which require 4 bytes in UTF-8) in labels long enough to force buffer reallocation. The fix moves the buffer growth before pointer calculation.

## Affected products

- CPAN Net::IDN::Punycode 2.301 through 2.589

## Timeline

- 2026-09-22: disclosed
- 2026-08-17: patched: Fix committed upstream in Net-IDN-Encode repository

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/robrwo/Net-IDN-Encode/commit/259e74c5739175b063c5393a4ce4a0705678ba61.patch](https://github.com/robrwo/Net-IDN-Encode/commit/259e74c5739175b063c5393a4ce4a0705678ba61.patch)

## Related threats

- [Net::IDN::Punycode CPU exhaustion via quadratic insertion cost](https://junglewise.ai/threats/cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu)
- [Net::IDN::Punycode memory leak in decode_punycode](https://junglewise.ai/threats/cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak)
- [Net::IDN::Punycode integer overflow in delta accumulator](https://junglewise.ai/threats/cve-2026-74765-net-idn-punycode-versions-before-2-590-for-perl-allow-an-out-of)
- [Net::IDN::Punycode heap buffer overflow in encode_punycode](https://junglewise.ai/threats/cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap)