CVE-2016-15059
Buffer overflow
- Published22 Sept 2026
Description
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRemediation
No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.
References
Related CVEs
Recent high-severity vulnerabilities sharing a weakness type.
Frequently asked
Is CVE-2016-15059 being actively exploited?
CVE-2016-15059 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.42%.
How severe is CVE-2016-15059?
CVE-2016-15059 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.42% probability of exploitation.
How do I fix CVE-2016-15059?
Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2016-15059 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.