CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode.
The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += (m-n) (h+1) has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.
Only the XS backend is affected.
Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net-IDN-Encodeto a version that resolves this vulnerability.Fixed in 2.590-TRIAL
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The application must encode an attacker-supplied string using the XS backend. A sufficiently large code point can trigger the overflow by itself; valid input can also trigger it, such as 1927 ASCII letters followed by U+10FFFF.
What is the practical impact on an affected process?
The encoder can copy a byte from outside its digit table into the encoded result or crash the process. The issue is reached before label-length validation because conversion functions encode the label before checking its length.
How can I determine whether my deployment is affected?
Deployments using a version before 2.590 and the XS backend are affected. The non-XS backend is not affected.