Net::IDN::Punycode CVE-2026-87078

Requires a host application that (1) uses the compiled XS backend of Net::IDN::Punycode (versions 2.302 up to but not including 2.590), not the pure-Perl PP fallback, and (2) passes attacker-controlled data into decode_punycode (to-Unicode direction) or encode_punycode. The to-Unicode path has no label-length bound (the 63-byte DNS limit is only enforced when converting to ASCII), so an attacker can supply arbitrarily long invalid labels. Exploitation needs repeated rejected calls to accumulate leaked memory into a DoS; a single call is harmless. Limiting factor: impact is confined to applications that expose this function to untrusted input, and switching to the pure-Perl backend avoids the flaw entirely.

The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real risk because of a mislabeling: this is a CWE-401 memory leak, and the 'leak' is of an unfreed output buffer, NOT disclosure of data to the attacker. The C:H metric and the 'Information Disclosure' tag are inconsistent with the described mechanism - a rejected label leaves an allocated scalar/buffer behind; the attacker never reads that memory. The genuine, well-supported impact is availability: unbounded process growth (twice the label length per rejected call, no successful call needed) leading to memory-exhaustion DoS, so A:H is defensible while C:H is not. No EPSS score, no CISA KEV listing, and no standalone public exploit are present in the input - only a vendor regression test (t/punycode_leak-xs.t) that demonstrates the growth. Exploitation is also application-gated: the flaw is in a library, so an attacker can only reach it if a host application feeds attacker-controlled input to the XS decode_punycode/encode_punycode path. Net priority: a real DoS worth patching in exposed IDN-processing services, but the 9.1 headline number is inflated by an incorrect confidentiality rating - treat as a high-availability-impact issue, not a data-breach issue.

An attacker repeatedly submits malformed IDN/Punycode labels (e.g. a long 'a'*2000 label plus an invalid byte such as 0xFF) to a Perl service that calls Net::IDN::Punycode::decode_punycode on untrusted input using the XS backend. Each rejected call croaks after allocating but before freeing a buffer sized at twice the input length, so sustained invalid traffic grows the process memory without bound until it is OOM-killed. No public weaponized exploit is identified; only a vendor regression test demonstrating the leak exists.