CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode.
Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of (STRLEN)-1, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label.
The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encodepunycode reaches the defect. The decoder is not affected.
A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Net-IDN-Encodeto a version that resolves this vulnerability.Fixed in 2.590-TRIAL
Event History
Frequently Asked Questions
Which applications are realistically exposed?
Applications are exposed only if they directly call encode_punycode with attacker-controlled bytes that have been marked as UTF-8 despite being malformed. Input read through PerlIO's :utf8 layer can produce this condition from malformed input.
Are callers of the documented conversion functions affected?
The documented conversion functions first match the label against Unicode properties, and that match dies for malformed flagged strings. The defect is reachable only through a direct call to encode_punycode.
What impact should be expected on different Perl and backend combinations?
With the XS backend on Perl 5.32 or later, processing can hang indefinitely. Earlier Perl versions with XS can produce a valid label for a different name, while the pure-Perl backend may crash with SIGBUS on Perl 5.28 or later, panic, or return a wrong label depending on the bytes.
What can be done before upgrading?
Avoid direct calls to encode_punycode for untrusted input. Use the documented conversion functions, which reject malformed UTF-8 at their Unicode-property validation step; the decoder is not affected.
How can I determine whether my code is affected?
Check whether it uses a Net::IDN::Punycode release before 2.590 and directly invokes encode_punycode. Calls that only decode labels, or that use the documented conversion functions instead of the direct encoder, do not reach this defect.