Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2016-15059 is a critical heap buffer overflow vulnerability in Net::IDN::Punycode versions before 2.301 that allows attackers to write past allocated memory boundaries during domain name encoding operations. The vulnerability exists in the XS backend's encode_punycode function, which allocates an output buffer based on input length but fails to properly validate bounds for the final digit write and null terminator of each encoding round. This affects any Perl application or system using vulnerable versions of this library for internationalized domain name (IDN) processing, including web servers, mail systems, and DNS tools that handle punycode conversion. The critical CVSS score of 9.8 reflects the potential for complete system compromise through memory corruption and arbitrary code execution.
While this CVE lacks direct MITRE ATT&CK technique mapping, Casky's 754 mapped security skills enable detection of the underlying exploitation patterns. Practitioners would observe anomalous behavior through memory safety monitoring—specifically unauthorized heap writes, unexpected process crashes, or successful code execution following punycode encoding operations. Extended reasoning across Casky's skill set would correlate this with CWE-122 (heap-based buffer overflow) detection patterns, revealing input validation failures in string processing functions. Security teams using Casky would identify suspicious punycode inputs (particularly those designed to overflow encoding buffers) and flag abnormal memory access patterns that precede exploitation, enabling prevention before attackers achieve execution primitives associated with techniques like T1203 (Exploitation for Client Execution) or memory-based privilege escalation.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2016-15059. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation