Net::IDN::Punycode vulnerabilities

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.

Net::IDN::Punycode versions before 2.590 for Perl do not validate UTF-8 input in encode_punycode. A flagged string with malformed bytes can hang, crash, or return a wrong label. Only direct calls to encode_punycode are affected; the decoder is not vulnerable.

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding long labels in decode_punycode. No label length limit exists in the to-Unicode direction, enabling CPU exhaustion attacks.

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. Decoding an attacker-supplied punycode label reads and writes freed heap memory.

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.