PT-2026-96670

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An issue exists that allows CPU exhaustion due to quadratic insertion cost when decoding long labels in the decode punycode function. In the XS backend, each decoded code point is inserted...

PT-2026-96671

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode::PP versions prior to 2.590 Description The decode punycode function in the pure-Perl decoder incorrectly handles truncated labels. The decoder uses a four-argument substr to read digits and checks the result with defined to...

PT-2026-96667

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode punycode computes the...

PT-2026-96669

Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions 2.302 through 2.589 Description An issue exists in the XS backend where the output buffer is leaked whenever a label is rejected in the decode punycode function. The XS backend allocates a scalar before validating...