ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2026-74765

Net-IDN-Encode · Vulnerability

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown
Original advisory

cve-program · CVE-2026-74765

Published

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API. Only the XS backend is affected. Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-74765

Published

Net-IDN-Encode

https://cpan.org/modules

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "collectionURL": "https://cpan.org/modules",
                    "defaultStatus": "unaffected",
                    "modules": [
                        "Net::IDN::Punycode"
                    ],
                    "packageName": "Net-IDN-Encode",
                    "packageURL": "pkg:cpan/Net-IDN-Encode",
                    "programFiles": [
                        "lib/Net/IDN/Punycode.xs"
                    ],
                    "programRoutines": [
                        {
                            "name": "Net::IDN::Punycode::encode_punycode"
                        }
                    ],
                    "repo": "https://github.com/robrwo/Net-IDN-Encode",
                    "versions": [
                        {
                            "lessThan": "2.590",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 22:49 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.