Description

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path, so each of the three croaks that reject a label leaves the scalar and its buffer allocated. Nothing bounds the label length in the to-Unicode direction, since the 63-byte DNS limit is checked only when converting to ASCII. Only the XS backend is affected. A sender who supplies invalid labels grows the process by twice the label length per rejected call, with no successful call needed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T08:16:40.530Z",
  "pubdate": "2026-09-22T08:16:40.530Z",
  "executiveSummary": "The Perl module Net::IDN::Punycode is vulnerable to a persistent memory leak within its XS backend component, specifically occurring during the decoding of invalid Punycode labels.\nThis vulnerability is classified as a resource exhaustion issue where failed input validation routines cause the process to retain allocated memory buffers instead of releasing them upon encountering an error.\nThe affected versions are 2.302 through 2.590. The vulnerability allows an unauthenticated attacker to remotely trigger cumulative memory growth in the host process by repeatedly submitting specially crafted invalid Punycode strings.\nBecause the allocation occurs before input validation and the cleanup logic is bypassed during error states, an attacker can consume significant system resources, potentially leading to a Denial of Service (DoS) condition via process memory exhaustion.\nNo specific privileges are required to reach the vulnerable code path, as the function is exposed to standard input processing workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper management of scalar buffer allocation within the XS backend of Net::IDN::Punycode during the execution of the decode_punycode function.\nIn the affected versions, the XS routine allocates memory for the output buffer prior to validating the integrity or structure of the provided Punycode input. The implementation allocates a buffer size equal to twice the input length, anticipating the transformation. However, the logic contains three distinct error-handling paths—triggered by invalid label formats—that invoke a 'croak' function to reject the input.\nCrucially, the scalar containing the allocated buffer is only freed or returned during a successful execution path. In the event that the input fails validation, the code triggers a 'croak' without executing the necessary cleanup routine to release the previously allocated buffer.\nBecause these error conditions occur prematurely, the memory remains allocated to the Perl process and cannot be reclaimed by the interpreter's garbage collector. Furthermore, the vulnerability is compounded by the lack of an input length constraint during the to-Unicode conversion process; the 63-byte DNS limit is only enforced during ASCII conversion, allowing an attacker to supply arbitrarily large malformed labels.\nThe attack flow proceeds as follows: 1) An attacker identifies an application interface that passes user-supplied data to Net::IDN::Punycode::decode_punycode. 2) The attacker sends a request containing a malformed Punycode label. 3) The XS backend allocates a scalar based on the input size. 4) The internal validation logic fails, triggering a 'croak' operation. 5) The buffer remains in memory, and the allocation is leaked. 6) The attacker repeats this process with high frequency or large payloads, causing the process memory to grow linearly with the size of the injected strings, eventually leading to application crash or system resource starvation."
}