Description

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label. Net::IDN::Punycode uses this backend wherever the XS does not build. The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-22T08:16:40.750Z",
  "pubdate": "2026-09-22T08:16:40.750Z",
  "executiveSummary": "Net::IDN::Punycode::PP versions prior to 2.590 contain a logical vulnerability within the decode_punycode function, leading to inconsistent Punycode label resolution. The pure-Perl implementation fails to correctly identify the termination of input strings during decoding. Specifically, the use of a four-argument substr function against an exhausted string returns an empty string rather than an undefined value, causing the decoder to process trailing data incorrectly. This discrepancy creates a mismatch between the pure-Perl backend and the XS backend, which correctly rejects the truncated input. Attackers can leverage this to craft specific Punycode labels that resolve to different names depending on the underlying environment's backend, potentially bypassing security filters, authentication mechanisms, or allow-lists that depend on consistent domain name interpretation. The issue presents a significant risk for systems relying on Punycode for IDN normalization where cross-environment consistency is required for security decisions.",
  "technicalDetails": "The vulnerability originates in the decode_punycode function of the pure-Perl implementation of Net::IDN::Punycode::PP. During the decoding process, the decoder iteratively reads digits from the input label. The implementation utilizes a four-argument substr function to extract these digits and relies on the defined() check to detect the end of the input string.\nIn Perl, when the substr function is performed on an exhausted string, it returns an empty string instead of undef. The decoder fails to account for this behavior, treating the resulting empty string as a valid input. The empty string is then erroneously converted into a numeric digit value that resides below the expected valid range of the Punycode algorithm. This calculation causes an unintended reduction of the accumulator state, which forces the decoder to derive an additional, non-existent code point and its corresponding position.\nThe attack flow involves the creation of a malformed or truncated Punycode label. When this label is processed by the pure-Perl backend, it produces a name containing a character that was never part of the original encoded sequence. Conversely, the XS backend for Net::IDN::Punycode correctly identifies the truncation and rejects the input, throwing an error. This divergence in output—where the same malicious input results in successful resolution on one system and failure on another—allows for exploitation in heterogeneous environments.\nAn attacker can exploit this discrepancy to bypass security controls by crafting labels that appear benign or conform to expected patterns in a standard-compliant (XS-based) system but resolve to a different, potentially malicious, target string in a pure-Perl environment. This is particularly critical in environments where cross-installation verification is expected to be deterministic. No authentication or elevated privileges are required to trigger this state, as the vulnerability is inherent in the string processing logic of the decoding component. Post-exploitation, this leads to semantic confusion, name spoofing, or the subversion of application-layer logic that expects canonical Punycode representation."
}