Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Net::IDN::Punycode versions 2.302 through 2.589 contain a resource exhaustion vulnerability where the XS backend allocates output buffers before validating input, failing to release memory when rejecting invalid labels. An attacker can trigger repeated allocation failures by submitting crafted internationalized domain names with invalid labels, causing the application to leak scalar buffers sized at twice the input length. With no bounds on label length in the Unicode decoding direction, this enables denial-of-service attacks against any Perl application using vulnerable versions of this module for domain name processing, particularly mail servers, DNS utilities, and web applications handling internationalized domain names.
While CVE-2026-87078 doesn't map directly to active MITRE ATT&CK techniques, Casky's extended reasoning capabilities would identify this as a Resource Exhaustion attack pattern (T1561 or related DoS vectors) by analyzing the repeating allocation-without-release code path. Practitioners using Casky would see findings flagging: (1) uncontrolled buffer allocation prior to input validation, (2) exception paths that bypass cleanup logic, and (3) unbounded input acceptance in security-critical parsing routines. The platform's skill mapping would recommend examining dependency manifests for affected module versions, monitoring for memory consumption spikes correlated with malformed internationalized domain submissions, and tracking application crashes linked to resource depletion—enabling teams to detect exploitation attempts even without explicit ATT&CK technique correlation.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-87078. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation