Is CVE-2026-87078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87078 being exploited in the wild.

How severe is CVE-2026-87078?

Critical severity, with a CVSS score of 9.1, published 22 September 2026.

Which products and versions are affected?

CPAN Net::IDN::Punycode 2.302 before 2.590.

Is there a fix for CVE-2026-87078?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87078 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-87078?

Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87078: Net::IDN::Punycode memory leak in decode_punycode

CVE-2026-87078 · Severity: critical · CVSS 9.1 · Published 2026-09-22

Net::IDN::Punycode is a Perl library that converts internationalized domain names to and from ASCII-compatible encoding. The XS (C language) backend allocates memory for decoded output before validating input, but only frees that memory on success. An attacker can send specially crafted invalid domain name labels to cause unbounded memory consumption, growing the process by up to 200 KB per rejected label with no limit.

Technologies: CPAN Net::IDN::Punycode. Vendors: CPAN.

Quick answers

Is CVE-2026-87078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87078 being exploited in the wild.
How severe is CVE-2026-87078?: Critical severity, with a CVSS score of 9.1, published 22 September 2026.
Which products and versions are affected?: CPAN Net::IDN::Punycode 2.302 before 2.590.
Is there a fix for CVE-2026-87078?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87078 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-87078?: Check whether you run CPAN Net::IDN::Punycode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The XS backend of Net::IDN::Punycode allocates an output scalar buffer sized at twice the input length before validating the label, and releases it only on the success path via the typemap. Three validation croaks in decode_punycode (non-base characters, incomplete code points, invalid digits) fail to free the allocated buffer, leaking twice the label length per rejection. Since the DNS 63-byte label limit is only enforced in the to-ASCII direction, an attacker can send unbounded invalid labels in the to-Unicode direction to exhaust memory.

Affected products

CPAN Net::IDN::Punycode 2.302 before 2.590

Timeline

2026-09-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.