Executive brief
Net::IDN::Punycode is a Perl library used to encode internationalized domain names. The XS backend contains an integer overflow vulnerability in the punycode encoding function that can be triggered by malicious Unicode input, allowing an attacker to read bytes from outside the digit table or crash the application.
Technical details
The XS backend stores the punycode delta and digit index in a signed int without overflow checks. The accumulation `delta += (m-n) * (h+1)` wraps on large code points, causing the digit index to exceed bounds. A negative or out-of-range index bypasses the bounds check (which only tests for values above 36), resulting in an out-of-bounds read from the digit table. Valid input such as 1927 ASCII letters followed by U+10FFFF can trigger the overflow, and the encoding function processes labels before checking their length.
Affected products
- CPAN Net::IDN::Punycode before 2.590
Timeline
- 2026-09-22: disclosed