Description

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-22T08:16:34.520Z",
  "pubdate": "2026-09-22T08:16:34.520Z",
  "executiveSummary": "Net::IDN::Punycode versions prior to 2.301 are susceptible to a heap-based buffer overflow vulnerability residing within the XS backend implementation. The flaw occurs due to insufficient bounds checking during the encoding process of Punycode labels.\nWhen processing attacker-supplied strings, the software fails to validate write operations against the allocated memory buffer, leading to memory corruption. An unauthenticated attacker can trigger this overflow by providing a specifically crafted input that forces the encoding routine to write beyond the designated boundaries of the scalar output buffer.\nThe primary security impact involves potential memory corruption on the heap, which may facilitate arbitrary code execution or cause an application crash depending on the surrounding memory layout. Because this vulnerability exists in the XS (C-based) backend of the Perl module, it bypasses native Perl memory safety mechanisms. System administrators and developers utilizing this module should prioritize upgrading to version 2.301 or later to eliminate the underlying flaw.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow located in the XS backend of Net::IDN::Punycode, specifically within the encode_punycode function. The root cause of the flaw is an inadequate boundary validation logic during the character encoding loop.\nThe XS backend allocates memory for the return scalar based on the length of the input string. During the Punycode conversion process, the algorithm constructs the encoded label within this pre-allocated buffer. While the implementation includes checks for buffer availability before writing specific digits during the primary encoding rounds, these checks are incomplete. Specifically, the routine fails to verify available memory before performing the write operation for the final digit of each round and the mandatory null-terminator (NUL) byte.\nExploitation occurs when an attacker provides an input string that, once processed into its Punycode representation, produces a string length exactly equal to or exceeding the allocated scalar buffer limit. When the final digits of the encoded sequence are written, or the termination character is appended, the pointer increments past the end of the allocated heap space.\nThe attack flow follows these steps: 1) The attacker supplies a crafted input string to the affected Perl application which invokes Net::IDN::Punycode::encode_punycode. 2) The XS backend initializes the destination scalar buffer. 3) The encoding loop proceeds until the buffer capacity is reached. 4) The function performs final writes—specifically the last digit or the NUL terminator—without checking the remaining buffer space. 5) These writes occur in the memory segment immediately following the buffer, effectively overwriting heap metadata or adjacent heap objects. This memory corruption can lead to controlled crashes (Denial of Service) or, with precise heap grooming, the hijacking of application control flow. Because the vulnerability resides in the XS extension, it is not constrained by Perl's internal memory management, making it a critical threat to the integrity of the process memory space."
}