Description

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API. Only the XS backend is affected. Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-22T08:16:40.143Z",
  "pubdate": "2026-09-22T08:16:40.143Z",
  "executiveSummary": "Net::IDN::Punycode versions prior to 2.590 are susceptible to an out-of-bounds read vulnerability within the XS backend implementation.\nThe vulnerability originates from an integer overflow occurring in the 'encode_punycode' function during the delta accumulation process.\nBy supplying crafted input strings containing specific Unicode code points, an attacker can trigger a wrap-around of the signed integer delta variable.\nThis overflow allows the derivation of an index that falls outside the bounds of the 36-entry digit table, leading to the unauthorized disclosure of process memory or a crash due to segmentation violation.\nThe vulnerability is exploitable via standard API calls when an attacker provides an maliciously formatted string for conversion.\nThe impact includes potential information disclosure or denial-of-service, as the system may copy arbitrary bytes from memory into the encoded output string.\nNo authentication or specific privileges are required beyond the ability to influence input passed to the encoder.",
  "technicalDetails": "The vulnerability resides in the XS backend of the Net::IDN::Punycode module, specifically within the logic used to process Punycode encoding. The root cause is a lack of overflow protection during the calculation of the delta variable, which tracks character displacement. In the function 'encode_punycode', the operation 'delta += (m-n) * (h+1)' is performed using a signed 'int' type. Because there are no boundary checks prior to this arithmetic operation, providing a sufficiently large Unicode code point (or a sequence of characters) causes the signed integer to overflow.\nThe internal logic uses the resulting delta value to calculate a digit index for accessing the Punycode digit table, which contains exactly 36 entries. The implementation performs a validation check to ensure the index is not greater than 36. However, because the variable is a signed 'int', a negative index resulting from a wrap-around fails to trigger this boundary condition, as the check only evaluates the upper bound. Furthermore, the index 36 itself is not correctly handled, allowing out-of-bounds access.\nThe exploitation flow begins when an attacker provides a malformed string to the 'encode_punycode' function. This can be achieved through various vectors, such as providing a label exceeding expected Unicode ranges or a sequence containing a high number of ASCII characters followed by a maximum-value Unicode character (U+10FFFF). When the accumulation logic wraps the integer value, the subsequent table look-up targets memory offsets adjacent to the intended 36-entry digit table.\nUpon reaching the table access, the encoder reads data from these adjacent memory locations and copies the resulting byte into the encoded output string. Depending on the memory layout and the specific value of the overflowed index, this results in the leakage of sensitive internal process memory into the output buffer. In instances where the pointer arithmetic resolves to invalid memory segments, the process triggers a segmentation fault, resulting in a denial-of-service condition. Because the encoding functions perform this calculation before validating the total label length, the vulnerability is accessible through any public API that exposes the XS backend encoder, regardless of input size constraints."
}