904 matches found
CVE-2026-87080: Improper Validation of Syntactic Correctness of Input
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
CVE-2026-87080
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...
Linux Distros Unpatched Vulnerability : CVE-2026-87078
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scal...
Linux Distros Unpatched Vulnerability : CVE-2026-74766
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in...
Linux Distros Unpatched Vulnerability : CVE-2026-74765
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend...
PT-2026-96667
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode punycode computes the...
PT-2026-96669
Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions 2.302 through 2.589 Description An issue exists in the XS backend where the output buffer is leaked whenever a label is rejected in the decode punycode function. The XS backend allocates a scalar before validating...
CVE-2026-74766: Use After Free
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...
CVE-2016-15059
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...
PT-2026-96666
Name of the Vulnerable Software and Affected Versions Net::IDN::Punycode versions prior to 2.590 Description An out-of-bounds read occurs in the XS backend due to an integer overflow of the delta accumulator within the encode punycode function. The XS backend stores the punycode delta and the...
Linux Distros Unpatched Vulnerability : CVE-2026-87079
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
SUSE SLES12 Security Update : perl-URI (SUSE-SU-2026:4070-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4070-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to...
SUSE SLED15 / SLES15 Security Update : perl-URI (SUSE-SU-2026:4046-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4046-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punyco...
CLEANSTART-2026-NE90506 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Multiple security vulnerabilities affect the sealed-secrets package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
PT-2026-99826
Multiple security vulnerabilities affect the sealed-secrets package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...
Linux Distros Unpatched Vulnerability : CVE-2026-92598
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycod...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
EUVD-2026-81298
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...
CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings...