CVE-2026-74765
UnknownSummary
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.
Risk Assessment
An attacker can supply a string causing an out-of-bounds read, potentially leading to memory corruption, process crash, or code execution.
Recommendation
Update Net::IDN::Punycode to version 2.590 or later. Avoid encoding untrusted input until patched.
Other vulnerabilities in Net::IDN::Punycode
See all- CVE-2026-87082Unknown
Net::IDN::Punycode versions before 2.590 for Perl do not validate UTF-8 input in encode_punycode. A flagged string with malformed bytes can hang, crash, or return a wrong label. Only direct calls to encode_punycode are affected; the decoder is not vulnerable.
- CVE-2026-87079Unknown
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding long labels in decode_punycode. No label length limit exists in the to-Unicode direction, enabling CPU exhaustion attacks.
- CVE-2026-87078Unknown
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.
- CVE-2026-74766Unknown
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. Decoding an attacker-supplied punycode label reads and writes freed heap memory.
- CVE-2016-15059Unknown
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.
Original NVD description (English source)
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API. Only the XS backend is affected. Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.