Executive brief
Net::IDN::Punycode is a Perl library that converts internationalized domain names to and from ASCII-compatible encoding. The XS (C language) backend allocates memory for decoded output before validating input, but only frees that memory on success. An attacker can send specially crafted invalid domain name labels to cause unbounded memory consumption, growing the process by up to 200 KB per rejected label with no limit.
Technical details
The XS backend of Net::IDN::Punycode allocates an output scalar buffer sized at twice the input length before validating the label, and releases it only on the success path via the typemap. Three validation croaks in decode_punycode (non-base characters, incomplete code points, invalid digits) fail to free the allocated buffer, leaking twice the label length per rejection. Since the DNS 63-byte label limit is only enforced in the to-ASCII direction, an attacker can send unbounded invalid labels in the to-Unicode direction to exhaust memory.
Affected products
- CPAN Net::IDN::Punycode 2.302 before 2.590
Timeline
- 2026-09-22: disclosed