CVE-2011-2939: Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used...

Security readout for executives and security teams

This CVE affects Perl's Encode Unicode decoding code. A crafted Unicode string could corrupt memory and crash a vulnerable process. The likely business impact is denial of service in applications that decode attacker-controlled Unicode with vulnerable Perl or Encode versions. Exposure is most likely in legacy Perl deployments or applications bundling old Encode versions and decoding untrusted Unicode strings. The source bundle does not provide precise CPEs, supported distribution package ranges, or affected application lists. Treat this as a legacy-platform remediation item, not an emergency active-exploitation incident. Prioritize systems where Perl processes internet, email, file, API, or queue input that may contain attacker-supplied Unicode. Mitigation focus: Upgrade Encode to 2.44 or later where possible.; Upgrade Perl to 5.15.6 or a vendor-patched supported package.; Review Ubuntu, Red Hat, and Mandriva advisories for distribution-specific packages..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.