https://bugzilla.redhat.com/show_bug.cgi?id=2548135
Bug ID: 2548135
Summary: CVE-2026-87078 perl-Net-IDN-Encode: Net::IDN::Punycode
versions from 2.302 before 2.590 for Perl leak the
output buffer on every rejected label in
decode_punycode [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["6cc2bbe0-28da-445a-ad27-2e2eaeae3274"]}
Component: perl-Net-IDN-Encode
Keywords: Security, SecurityTracking
Severity: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output
buffer on every rejected label in decode_punycode.
The XS backend allocates the scalar it returns before it validates the input,
sizing the buffer at twice the input length. The scalar is released only on the
success path, so each of the three croaks that reject a label leaves the scalar
and its buffer allocated. Nothing bounds the label length in the to-Unicode
direction, since the 63-byte DNS limit is checked only when converting to
ASCII.
Only the XS backend is affected.
A sender who supplies invalid labels grows the process by twice the label
length per rejected call, with no successful call needed.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2548135
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202548135%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
