CVE-2011-2939: Dan Kogai Encode Module

Medium severity, CVSS 5.1. EPSS: 2.6% chance of exploitation in the next 30 days.

Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

Affected products

• Dan Kogai Encode Module: up to and including 2.43; version 0.93 only; version 0.94 only; version 0.95 only; version 0.96 only; version 0.97 only; …
• Perl Perl: up to and including 5.14.2; version 5.8.1 only; version 5.8.2 only; version 5.8.3 only; version 5.8.4 only; version 5.8.5 only; …

Published 2012-01-13. Last modified 2026-06-16.