CPANSA-Net-IDN-Encode-2026-74765: Net-IDN-Encode vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-09-22T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-09-22T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score 6.5 Severity Medium
Original language Language en
Also referred to

Vulnerability Description

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.

The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.

Only the XS backend is affected.

Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.

Vulnerabilities

CVE-2026-74765

Vulnerability Description

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.

The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.

Only the XS backend is affected.

Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.

Weakness CWE-125 : Out-of-bounds Read

Product status

Known affected
Product Score
Net-IDN-Encode less than 2.590
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L 6.5 Medium
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Tue Sep 22 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/