Description

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of `(STRLEN)-1`, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label. The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected. A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-22T08:16:40.973Z",
  "pubdate": "2026-09-22T08:16:40.973Z",
  "executiveSummary": "Net::IDN::Punycode versions prior to 2.590 are susceptible to memory corruption, infinite loops, and incorrect data processing due to a lack of input validation within the encode_punycode function.\nThe vulnerability arises because the module fails to verify that input strings are well-formed UTF-8, allowing malformed bytes—often generated by Perl's :utf8 PerlIO layer—to reach the internal XS or pure-Perl encoders.\nThe impact depends on the Perl environment, ranging from denial-of-service via infinite loops (hanging) or process crashes (SIGBUS/panic) to data integrity compromise where the function returns a technically valid but semantically incorrect label.\nThis flaw is exploitable when an application passes attacker-controlled, malformed UTF-8 directly to the encode_punycode function. While high-level conversion wrappers that utilize Unicode property matching may incidentally mitigate the issue by crashing earlier, direct calls bypass these protections, posing significant risks to system stability and information mapping security.",
  "technicalDetails": "The root cause of this vulnerability is the failure to perform validation of the UTF-8 flag status in conjunction with the actual byte sequence within the encode_punycode function. When input data is treated as UTF-8 by Perl but contains malformed byte sequences, the internal encoder logic enters undefined or unstable states.\nIn the XS backend on Perl 5.32 and later, the logic for processing malformed sequences incorrectly calculates length as (STRLEN)-1. This error causes the scanning pointer to regress by one byte instead of advancing, leading to an infinite loop that results in a process hang. On earlier Perl versions, the XS backend may fail to detect the invalid encoding entirely, leading to the generation of a valid punycode label that corresponds to an incorrect or unintended domain name, facilitating potential identity spoofing.\nThe pure-Perl backend is similarly impacted. It performs regex operations on the flagged string, which causes an abort with a SIGBUS signal on Perl 5.28 and later, or triggers a panic error. These crashes represent a classic denial-of-service vector triggered by malicious input.\nThe attack flow follows a specific path: An attacker submits a payload containing malformed UTF-8 bytes to an application that utilizes Net::IDN::Punycode to process labels. If the application makes a direct call to encode_punycode, the malformed data bypasses common validation wrappers (which check Unicode properties). Once the data reaches the encoder, the internal C or Perl code performs operations on the malformed sequence. Depending on the environment, this results in immediate process termination (crashing), indefinite resource consumption (hanging), or the production of incorrect labels that may deceive downstream systems or users relying on the punycode representation.\nThis vulnerability is particularly dangerous because it bypasses standard encoding expectations. By providing carefully crafted malformed UTF-8, an attacker can manipulate the internal state of the encoder, potentially leading to arbitrary label generation or service interruption. The decoder component of Net::IDN::Punycode is not affected by this specific defect, limiting the scope of the vulnerability to the encoding process."
}