CVE-2026-87078: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-87078 is a memory leak (missing release of memory after effective lifetime) vulnerability in the Net::IDN::Punycode module (part of the Net-IDN-Encode Perl distribution), affecting versions 2.302 through 2.589. The flaw exists exclusively in the XS (C-based) backend of the decode_punycode function, where the output scalar buffer is allocated before input validation and is never freed on rejection paths. It was published on September 22, 2026, with a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime). In the XS backend, both encode_punycode and decode_punycode allocate a return scalar (RETVAL) sized at twice the input length before performing any input validation. When the input is rejected — via one of several croak calls for conditions such as non-base characters, incomplete encoded code points, invalid digits, or exceeded punycode limits — the scalar and its buffer are left allocated because the typemap only mortalizes (frees) the scalar on the success path. Additionally, no upper bound is enforced on label length in the to-Unicode direction, since the 63-byte DNS label limit is only checked during ASCII conversion, allowing arbitrarily large invalid labels to be processed. The fix introduced a croak_free helper (commit 92572f7) and subsequently a mortal-at-creation approach (commit edad63e) to ensure the scalar is always freed on any croak path (Patch 1, Patch 2).

An unauthenticated remote attacker can cause unbounded memory growth in any Perl process that uses the XS backend of Net::IDN::Punycode to decode attacker-supplied labels. Each rejected call leaks memory equal to twice the input label length, with no successful call required; empirical testing showed 25,000 rejected decodes of a 2,000-byte label leaked approximately 100 MiB. Sustained exploitation can exhaust available memory, crashing the application or severely degrading performance, resulting in a denial of service. Confidentiality impact is also rated High in the CVSS score, potentially reflecting exposure of heap contents in certain scenarios (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is network-exploitable with no authentication or user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is 0.0, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify target: Locate Perl applications that use Net::IDN::Encode or Net::IDN::Punycode with the XS backend (versions 2.302–2.589) and accept externally supplied domain names or punycode labels for decoding (e.g., internationalized domain name processing services, email validators, DNS utilities).
2. Craft invalid punycode labels: Construct large invalid punycode labels — for example, a string of 2,000+ ASCII characters followed by a non-base character (e.g., 0x80) or an invalid digit sequence — that will trigger a croak in decode_punycode without being accepted.
3. Send repeated requests: Repeatedly submit these invalid labels to the target application's punycode decoding endpoint. Each rejected call leaks memory equal to twice the label length; no successful decode is needed.
4. Exhaust memory: Continue sending requests at high volume. As the process's resident set size grows without bound, the target application will eventually exhaust available memory, causing a crash or severe performance degradation, achieving denial of service (Patch 1, GitHub Advisory).

• Process Behavior: Perl process resident set size (RSS) growing continuously without a corresponding increase in legitimate workload; memory growth proportional to request volume targeting punycode decoding endpoints.
• Logs: High volume of requests containing malformed or oversized domain labels (non-ASCII characters in punycode position, labels exceeding 63 bytes) in application or web server access logs; repeated error/exception log entries from Net::IDN::Punycode such as non-base character in input for decode_punycode, invalid digit in input for decode_punycode, or incomplete encoded code point in decode_punycode.
• Network: Unusual traffic patterns with repeated requests containing large, malformed internationalized domain name labels; automated/scripted request patterns with no successful decodes.
• System: OOM (out-of-memory) killer events in system logs (/var/log/syslog, dmesg) terminating the Perl application process; sudden application crashes correlated with high-volume punycode decode requests.

Upgrade Net-IDN-Encode to version 2.590 or later, which resolves the memory leak by ensuring the output scalar is always freed on all rejection paths in the XS backend (MetaCPAN, GitHub Advisory). If immediate patching is not possible, implement input validation to enforce a maximum label length (e.g., 63 bytes per DNS label) before passing input to decode_punycode, or restrict network access to services that invoke punycode decoding. Switching to the pure-Perl (PP) backend is also a viable temporary workaround, as only the XS backend is affected.