Executive brief
Net::IDN::Punycode is a Perl library that converts domain names to Punycode format for internationalized DNS. When given malformed UTF-8 input, the encoder can hang indefinitely, crash with a memory error, or produce incorrect domain names. An application that directly calls the encode_punycode function with attacker-supplied bytes could be exploited to cause denial of service or data corruption.
Technical details
The vulnerability exists in both the XS (C) and pure-Perl implementations of encode_punycode, which fail to validate UTF-8 input before processing. On Perl 5.32+, the XS backend's character decoder reports malformed sequences with length (STRLEN)-1, causing an infinite loop that scans backwards. On earlier Perl versions, the XS backend returns a valid Punycode label for a different domain name. The pure-Perl backend may abort with SIGBUS or crash with a panic. The documented conversion functions are not affected as they validate input against Unicode properties first; only direct calls to encode_punycode are vulnerable.
Affected products
- Perl CPAN Net::IDN::Punycode before 2.590
Timeline
- 2026-09-22: disclosed