CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode.
The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation.
Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected.
Decoding an attacker-supplied punycode label reads and writes freed heap memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net-IDN-Encodeto a version that resolves this vulnerability.Fixed in 2.590-TRIAL
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when they use Net::IDN::Punycode versions from 2.301 before 2.590 with the XS backend and decode attacker-supplied punycode labels. The affected code was introduced in version 2.301.
Are non-XS implementations affected?
No. The issue affects only the XS backend.
What kind of input triggers the memory error?
An attacker needs to provide a punycode label that decodes to code points requiring more output-buffer space, causing a reallocation. Code points above U+FFFF require four bytes in the output, and labels containing such code points can force the vulnerable reallocation path.
What can be done if an immediate upgrade is not possible?
Avoid decoding attacker-supplied punycode labels through the affected XS backend. Updating to version 2.590 removes the affected version range.