Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
