Back Linuxsecurity

Fedora 43 Updates perl-Net-IDN

Linuxsecurity •LinuxSecurity Advisories • November 10, 2026

Critical WordPress Flaw Exploited in the Wild: Learn how to protect your site and check your core update window. ×

This module provides an easy-to-use interface for encoding and decoding

Internationalized Domain Names (IDNs).

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

* Sun Nov 1 2026 Emmanuel Seyman - 2.600-1 - Update to 2.600 (fixes multiple CVEs) - Minor improvements to the spec file

Fedora Update Notification FEDORA-2026-3cb8ce0117 2026-11-10 01:52:44.743956+00:00 Name : perl-Net-IDN-Encode Product : Fedora 43 Version : 2.600 Release : 1.fc43 URL : Summary : Internationalizing Domain Names in Applications (IDNA) Description : This module provides an easy-to-use interface for encoding and decoding Internationalized Domain Names (IDNs).

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3cb8ce0117' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in perl-Net-IDN-Encode Fixed in Fedora Updates On November 10, 2026, Fedora released updates for the perl-Net-IDN-Encode module to address multiple vulnerabilities. The updates fix several critical and high-severity CVEs, including CVE-2026-87078 and CVE-2026-87080, which involve memory leaks and heap use-after-free issues. These vulnerabilities affect systems using the perl-Net-IDN-Encode module, which is utilized for encoding Internationalized Domain Names (IDNs). The CVEs were published on September 22, 2026, and have a CVSS score ranging from 6.5 to 9.1, indicating varying levels of severity. Users are advised to update their systems to version 2.600 to mitigate these risks. The updates can be installed using the 'dnf' package manager. As of now, there are no reports of in the wild. 3 sources 46

Extracted Entities

CVEs (7)

CVE-2026-74765 CVE-2026-74766 CVE-2026-87078 CVE-2026-87079 CVE-2026-87080 CVE-2026-87081 CVE-2026-87082

CWE Weaknesses (3)

CWE-125 - Out-of-bounds Read CWE-190 - Integer Overflow Or Wraparound CWE-416 - Use After Free