OPENSUSE-SU-2026:12468-1

Vulnerability from csaf_opensuse - Published: 2026-11-06 00:00 - Updated: 2026-11-07 10:42
Summary
perl-Net-IDN-Encode-2.600.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: perl-Net-IDN-Encode-2.600.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the perl-Net-IDN-Encode-2.600.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12468
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-74765
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-74766
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact critical
CVE-2026-87078
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact critical
CVE-2026-87079
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact important
CVE-2026-87080
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact critical
CVE-2026-87081
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact important
CVE-2026-87082
Affected products
Recommended 4 products, the same list as for CVE-2026-74765
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-Net-IDN-Encode-2.600.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-Net-IDN-Encode-2.600.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12468",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12468-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-74765 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-74765/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-74766 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-74766/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87078 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87078/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87079 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87079/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87080 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87081 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87081/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-87082 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-87082/"
      }
    ],
    "title": "perl-Net-IDN-Encode-2.600.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-07T10:42:13Z",
      "generator": {
        "date": "2026-11-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12468-1",
      "initial_release_date": "2026-11-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-07T10:42:13Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
                "product": {
                  "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
                  "product_id": "perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Net-IDN-Encode@2.600.0-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
                "product": {
                  "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
                  "product_id": "perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Net-IDN-Encode@2.600.0-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
                "product": {
                  "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
                  "product_id": "perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Net-IDN-Encode@2.600.0-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64",
                "product": {
                  "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64",
                  "product_id": "perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Net-IDN-Encode@2.600.0-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64"
        },
        "product_reference": "perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le"
        },
        "product_reference": "perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x"
        },
        "product_reference": "perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        },
        "product_reference": "perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74765",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-74765"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.\n\nThe XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.\n\nOnly the XS backend is affected.\n\nEncoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-74765",
          "url": "https://www.suse.com/security/cve/CVE-2026-74765"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-74765"
    },
    {
      "cve": "CVE-2026-74766",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-74766"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode.\n\nThe XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation.\n\nVersion 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected.\n\nDecoding an attacker-supplied punycode label reads and writes freed heap memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-74766",
          "url": "https://www.suse.com/security/cve/CVE-2026-74766"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-74766"
    },
    {
      "cve": "CVE-2026-87078",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87078"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode.\n\nThe XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII.\n\nOnly the XS backend is affected.\n\nA sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87078",
          "url": "https://www.suse.com/security/cve/CVE-2026-87078"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-87078"
    },
    {
      "cve": "CVE-2026-87079",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87079"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode.\n\nThe XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character at a time. The scan runs once per code point over the output built so far, so the cost is quadratic in the label length. The pure-Perl backend downgrades its input to bytes so that substr can index it directly, but takes its working copy before the downgrade, so when the input carries the UTF-8 flag every substr on the copy scans from the start, with the same quadratic cost.\n\nNothing bounds the label length in the to-Unicode direction. The 63-byte DNS limit is checked only when converting to ASCII, so domain_to_unicode and uts46_to_unicode pass an attacker-supplied label of any length to the decoder.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87079",
          "url": "https://www.suse.com/security/cve/CVE-2026-87079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-87079"
    },
    {
      "cve": "CVE-2026-87080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.\n\nThe pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label.\n\nNet::IDN::Punycode uses this backend wherever the XS does not build.\n\nThe two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87080",
          "url": "https://www.suse.com/security/cve/CVE-2026-87080"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-87080"
    },
    {
      "cve": "CVE-2026-87081",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87081"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii.\n\nto_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87081",
          "url": "https://www.suse.com/security/cve/CVE-2026-87081"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-87081"
    },
    {
      "cve": "CVE-2026-87082",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-87082"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.\n\nNeither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label.\n\nThe documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected.\n\nA direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-87082",
          "url": "https://www.suse.com/security/cve/CVE-2026-87082"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-IDN-Encode-0:2.600.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-87082"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.