Back Linuxsecurity

Fedora 45 perl-Net-IDN

Linuxsecurity •LinuxSecurity Advisories • November 10, 2026

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs in perl-Net-IDN-Encode Fixed in Fedora Updates On November 10, 2026, Fedora released updates for the perl-Net-IDN-Encode module to address multiple vulnerabilities. The updates fix several critical and high-severity CVEs, including CVE-2026-87078 and CVE-2026-87080, which involve memory leaks and heap use-after-free issues. These vulnerabilities affect systems using the perl-Net-IDN-Encode module, which is utilized for encoding Internationalized Domain Names (IDNs). The CVEs were published on September 22, 2026, and have a CVSS score ranging from 6.5 to 9.1, indicating varying levels of severity. Users are advised to update their systems to version 2.600 to mitigate these risks. The updates can be installed using the 'dnf' package manager. As of now, there are no reports of in the wild. 3 sources 46

Extracted Entities

Companies (1)

Fedora

CVEs (3)

CVE-2026-74765 CVE-2026-74766 CVE-2026-87078