EUVD-2026-84293
GHSA-m8c4-89qh-3j3f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote crafted label, no auth/UI (AV:N/AC:L/PR:N/UI:N); impact is a context-dependent name-confusion differential giving limited integrity/confidentiality (C:L/I:L) with no genuine availability loss (A:N), so vendor C:H/A:H is overstated.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode.
The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on an exhausted string returns the empty string rather than undef, so decoding continues past the end. The empty string converts to a digit value below the range, reducing the accumulator, and the decoder derives one extra code point and its position from it. The result is deterministic. The XS backend rejects the same label.
Net::IDN::Punycode uses this backend wherever the XS does not build.
The two backends disagree about what such a label means, so a sender can pick a label that one installation resolves to a name and another rejects.
AnalysisAI
The pure-Perl punycode decoder in Net::IDN::Punycode::PP, shipped in Perl Net-IDN-Encode distributions before 2.590, silently decodes a truncated label into a name that contains a code point the label never encoded, while the compiled XS backend rejects that same label - a parser differential an unauthenticated remote sender can trigger by supplying a malformed punycode label (for example 'NMzZNlL6SU', 'abc-td' or 'z'). Only installations where the XS backend does not build and the pure-Perl path is used are exposed, and the discrepancy only becomes a security problem when the decoded name feeds a security-relevant decision (allowlisting, host matching, deduplication) that is expected to agree with a system running the XS backend. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the affected installation to be using the pure-Perl backend, Net::IDN::Punycode::PP - the description states this backend is used 'wherever the XS does not build,' so installations with the compiled XS backend are NOT vulnerable (XS rejects the same label). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) substantially overstates real-world risk for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading Net-IDN-Encode / Net::IDN::Punycode::PP to version 2.590 or later, which changes the end-of-input check from `defined $cp` to `length $cp` in lib/Net/IDN/Punycode/PP.pm and adds a regression test (t/punycode_security-pp.t) covering truncated labels; the upstream commit is available at https://github.com/robrwo/Net-IDN-Encode/commit/48436c7ad2c4d4c6398110e11133754fc476a783.patch and the release changes file at https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory which services depend on Net-IDN-Encode and determine whether each is running the pure-Perl fallback rather than the XS backend - any host where the XS backend fails to compile is in scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today