Net::IDN::Punycode EUVD-2026-84292

Requires an application that passes attacker-controlled labels to the to-Unicode direction of Net::IDN::Punycode (before 2.590) - specifically domain_to_unicode or uts46_to_unicode - without independently bounding label length, since the 63-byte DNS limit is enforced only in the to-ASCII direction. Both the XS backend (buffer re-scanned per code point) and the pure-Perl backend (when input carries the UTF-8 flag, substr scans from the start on the pre-downgrade copy) are affected. No authentication, no user interaction, and no non-default configuration are needed once such an untrusted decode path exists; the practical limit is simply that the vulnerable function must be reachable with external input.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) is consistent with the description: a CWE-407 algorithmic-complexity flaw that is availability-only (C:N/I:N), triggerable remotely and unauthenticated whenever an application feeds attacker-controlled domain labels to the to-Unicode decoder. The impact is capped at CPU exhaustion (single-request quadratic blow-up, e.g. a ~200,000-char 'a' label per the vendor regression test), not code execution or data exposure, so the practical risk is denial of service against Perl services that decode untrusted IDN/punycode input. No EPSS score, KEV listing, or SSVC decision data is provided, and no public exploit is listed in the input - so there is no public exploit identified at time of analysis, though the trigger is trivial and well-documented in the patch's test file, making reliable exploitation straightforward for anyone who reads the advisory. Key caveat: the raw CVSS assumes the vulnerable decode path is reachable with attacker input; real exposure is gated on the application actually calling domain_to_unicode/uts46_to_unicode on unbounded external input, since the 63-byte DNS length check only applies in the to-ASCII direction. The input Tag 'Information Disclosure' directly contradicts the CVSS impact metrics (C:N/I:N) and the CWE-407 classification - this is a resource-exhaustion/DoS issue, not information disclosure.

An attacker submits an abnormally long punycode label (e.g. via an email address domain, HTTP Host/URL, or DNS name that a Perl service normalizes with domain_to_unicode/uts46_to_unicode). Because no length bound exists in the to-Unicode direction, decode_punycode performs a quadratic scan of the growing output buffer, pinning a CPU core for seconds to minutes per request and enabling low-volume denial of service. No authentication or user interaction is required and no public weaponized exploit is listed, but the vendor's own regression test ('a' x 200000) demonstrates the trigger.