Description

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation. Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected. Decoding an attacker-supplied punycode label reads and writes freed heap memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-22T08:16:40.267Z",
  "pubdate": "2026-09-22T08:16:40.267Z",
  "executiveSummary": "Net::IDN::Punycode versions 2.301 through 2.589 are susceptible to a heap use-after-free vulnerability located within the XS backend implementation of the decode_punycode function. This vulnerability arises due to improper memory management during the dynamic resizing of the output buffer when processing specific punycode sequences.\nAn attacker capable of supplying a crafted punycode label can trigger a buffer reallocation while maintaining a stale pointer to the previously freed memory. This allows for an out-of-bounds write or read operation during the decoding process.\nThe impact of this vulnerability includes potential heap corruption, unauthorized memory disclosure, or the execution of arbitrary code, depending on the attacker's ability to influence the heap layout. Exploitation does not require authentication and can be triggered remotely through any application that utilizes the affected Perl module to decode user-supplied input. This flaw represents a significant risk to systems performing IDN (Internationalized Domain Name) processing, necessitating an urgent update to the latest patched version of the software.",
  "technicalDetails": "The vulnerability is situated within the XS (C interface) implementation of the decode_punycode function. The logic responsible for decoding punycode sequences into a Perl scalar fails to maintain memory integrity during buffer expansion. Specifically, when the decoder determines that an decoded code point necessitates a larger buffer—common with code points above U+FFFF requiring four bytes—it triggers a reallocation of the output buffer.\nThe root cause is an inconsistent update mechanism for internal memory pointers. The function computes the insertion pointer for a decoded code point before performing the buffer growth operation. When the buffer is too small to accommodate the incoming code point, the underlying memory is reallocated. While the system correctly updates the internal pointers of the Perl scalar, it fails to refresh the 'insertion pointer' variable currently held in the function's local scope.\nThe execution flow proceeds as follows: 1) The function calculates the current insertion address based on the existing heap allocation. 2) A check verifies if the buffer has sufficient space for the pending code point. 3) If space is insufficient, the buffer is reallocated, effectively deallocating the original memory block and creating a new one at a different heap location. 4) The function continues using the original insertion pointer, which now points to freed (or potentially repurposed) heap memory. 5) The subsequent move operation and the code point write occur on this stale pointer, resulting in a use-after-free condition.\nThis defect was introduced in version 2.301 as part of a previous fix for CVE-2016-15059. The issue is localized strictly to the XS backend. An attacker can exploit this by providing a specially crafted punycode label containing a sequence of high-value code points that force a buffer expansion at an opportune moment. Because this occurs during the decoding of arbitrary input, any application relying on Net::IDN::Punycode for input sanitization or domain processing is exposed. Successful exploitation may lead to heap memory corruption, which can be leveraged for reliable arbitrary code execution or to bypass security controls by corrupting adjacent data structures in the heap."
}