Executive brief
Net::IDN::UTS46 is a Perl library that converts domain names to ASCII-compatible format (punycode). An attacker can submit domain names with very long labels containing many distinct non-ASCII characters, causing the library to consume CPU resources in quadratic proportion to label length before rejecting the input. This could slow down or halt systems that process untrusted domain names, such as email validators or DNS utilities.
Technical details
The to_ascii function applies the 63-byte DNS limit only after punycode-encoding each label. The punycode encoder follows RFC 3492, whose algorithm runs in O(n²) time when labels contain many distinct non-ASCII code points. An overlong label of distinct Unicode characters triggers minutes of CPU consumption before the length check rejects it. The fix pre-checks label length before encoding.
Affected products
- CPAN Net::IDN::UTS46 before 2.590
Timeline
- 2026-09-22: disclosed
- 2026-09-01: patched