EUVD-2026-84289
GHSA-xw3q-mp5h-p8jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted IDN label to app
-
DeliveryApp calls XS encode_punycode
-
ExploitOverflow delta accumulator, index escapes digit table
-
ExecutionRead byte outside table
-
ImpactLeak adjacent byte in output or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that a consuming application call Net::IDN::Punycode's XS backend (encode_punycode) on attacker-influenced input - the pure-Perl PP backend is NOT affected, so exploitation is gated on the XS module being installed and used. The trigger is a Perl string containing a code point that overflows the signed-int delta accumulator: either a single code point beyond the Unicode range (e.g. chr(0xFFFFFFFF)), or a long valid label such as 1927 ASCII letters followed by U+10FFFF. Because the API encodes a label before it validates length, an over-long label reaches the encoder through the documented interface. Impact is limited to a one-byte out-of-bounds read copied into output (C:L) or a process crash (A:L); no code execution or integrity impact. |
| Impact | This is a genuine but bounded issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, base 6.5) reflects a memory-safety defect in a network-reachable code path with only partial confidentiality (a single out-of-bounds byte copied into the encoded output) and partial availability (process crash) impact - no integrity impact, no code execution. No EPSS score, no CISA KEV listing, and no standalone public exploit are present in the input, so exploitation status is 'no public exploit identified' - though the vendor patch ships a proof-of-trigger regression test (t/punycode_security-xs.t) demonstrating the crash with |
| Exploit ScenarioDerived | An application uses Net::IDN::Punycode's XS backend to encode user-supplied domain-label or IDN input. An attacker submits a label containing a code point beyond the Unicode range (or a long valid label such as 1927 ASCII letters followed by U+10FFFF), overflowing the signed-int delta accumulator so the derived digit index falls outside the 36-entry table. No public exploit exists, but the vendor's own patch includes a trigger test; the result is either a leaked byte from adjacent memory embedded in the encoded output or a process crash (DoS). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
RemediationAI
Vendor-released patch: upgrade Net::IDN::Encode to 2.590 or later, which ships Net::IDN::Punycode 2.590 and adds explicit overflow guards in lib/Net/IDN/Punycode.xs - the delta accumulation now croaks with "input exceeds punycode limit" when (m-n) * (h+1) or the skip offset would exceed PERL_INT_MAX, the delta-equals-PERL_INT_MAX condition is checked, and the digit-loop bound was corrected from q > BASE to q >= BASE so index 36 is also rejected. The fixes are visible in upstream commits 27a91ccdb6c9b41f75ba198f5ae154d14e225de2, 81c7f99fe7430bdc5116081508dffdb56f376861 and 89d5aa8d3504c5e96061ab76d1541a89c16157cf; note that the 2.590 change record is published as a TRIAL release, so confirm with your distribution maintainer that the packaged (non-trial) version carries the same guards before treating the module as fixed. Where upgrading immediately is not possible, the most effective mitigation is to avoid the affected code path entirely by forcing the pure-Perl implementation - call Net::IDN::Punycode::PP::encode_punycode or ensure the XS module is not built/loaded - at the cost of noticeably slower encoding throughput and the need to audit every call site that currently references the XS package. A complementary control that does not depend on the backend is strict pre-validation at the API boundary: reject or strip any Perl string containing code points above U+10FFFF and enforce the 63-octet label limit before calling encode_punycode, since the vulnerable encoder checks label length only after encoding; this requires adding input validation in every consuming application and will not help callers that pass raw untrusted strings straight through. Because the impact ceiling is a one-byte information disclosure or a crash, do not treat this as an urgent out-of-band fix, but do schedule the upgrade and, in the interim, consider isolating processes that perform IDN conversion so a crash cannot take down a shared service. Advisory and change details: https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes and https://nvd.nist.gov/vuln/detail/CVE-2026-74765.
Affected ProductsAI
Affected is the Net::IDN::Punycode module distributed with Net::IDN::Encode in all versions before 2.590, specifically when built with the XS/compiled backend (the default when a C compiler is available); the pure-Perl Net::IDN::Punycode::PP backend is not vulnerable. Downstream consumers include any Perl application, library, or service that converts Unicode labels or hostnames to ASCII via Net::IDN::Punycode::encode_punycode, Net::IDN::Encode, or higher-level IDN handling that delegates to it, which in practice means IDN domain-normalization, URL parsing, and e-mail/URI validation code that processes untrusted names. No CPE identifiers were supplied with the advisory data; the affected component is identified by distribution name and version. Version guidance and the change record are available at https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes, with the authoritative NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-74765 and the EUVD record EUVD-2026-84289. Packaging-level exposure is broad because Net::IDN::Encode is commonly resolved automatically as a dependency of IDN-aware Perl tooling, so the true reach of the bug depends on whether the XS build was used in each installed environment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Punycode encoding is defined in RFC 3492, whose bias-adaptation algorithm (section 6.4) maintains a running "delta" accumulator across insertion points in the label. In Net::IDN::Punycode's XS backend that accumulator, together with the digit index derived from it, is held in a signed C int. The update delta += (m-n) * (h+1) is performed with no overflow check, so a sufficiently large code point wraps the signed accumulator negative or past INT_MAX, and the subsequently computed digit index (delta % 36, then divided down) leaves the valid 0-35 range of the digit table. The loop's only guard rejects indices greater than 36, so a negative index and the value 36 itself both slip through, causing an out-of-bounds read of the digit table on the final access and copying an adjacent byte into the output. Two trigger families are described: a single Perl code point outside the Unicode range (Perl strings can hold values such as chr(0xFFFFFFFF), which overflow the accumulation on their own), and fully valid input such as 1927 ASCII letters followed by U+10FFFF. Because the encoder performs encoding before checking label length, an over-long label reaches the vulnerable arithmetic through the documented API. This is CWE-190 (integer overflow or wraparound) manifesting as an out-of-bounds read (buffer overflow tag). Only the XS backend contains the unsafe arithmetic; the pure-Perl implementation does not.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Agree with vendor: library reachable via app-fed input (AV:N/PR:N), single-code-point trigger is easy (AC:L); impact is one OOB byte leak (C:L) or crash (A:L), no integrity.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.
The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += (m-n) * (h+1) has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.
Only the XS backend is affected.
Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB