EUVD-2026-84295
GHSA-4v8j-337r-265v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach app that calls encode_punycode directly
-
DeliverySubmit malformed/truncated UTF-8 bytes
-
ExploitEncoder scan steps back on (STRLEN)-1
-
ExecutionInfinite loop or SIGBUS/panic
-
ImpactWorker hang or crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application call Net::IDN::Punycode::encode_punycode() DIRECTLY on attacker-influenced input; the documented conversion wrappers (domain_to_ascii, email_to_ascii) are NOT vulnerable because they first perform a Unicode-property match that dies on a malformed-UTF-8 string. The input must carry Perl's UTF-8 flag over malformed bytes - the exact state produced automatically by reading through the :utf8 PerlIO layer - so any code path that reads untrusted text via :utf8 and passes it to the low-level encoder is exposed. Impact is version-dependent: an unending hang on perl 5.32 and later (XS backend), a SIGBUS crash on perl 5.28 and later (pure-Perl backend), a panic-die, or a silently wrong Punycode label. The decoder is unaffected. Limiting factors: availability-only impact, no authentication or user interaction needed at the API level, but real reach is gated by the uncommon direct-encoder usage pattern. |
| Impact | Signals converge on a low-to-moderate real-world priority despite the 7.5 (HIGH) score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is availability-only DoS, and the 7.5 is driven entirely by A:H - there is no confidentiality or integrity impact in the vendor scoring (though the description's 'returns a wrong label for a name the input never held' is a genuine integrity concern the vendor did not score). EPSS is very low (0.16%, 6th percentile), there is no CISA KEV listing and no public exploit identified, and SSVC reports Exploitation=none. SSVC Automatable=yes and Technical Impact=partial are consistent with a cheap, network-reachable DoS but not with mass targeting given the reachability constraint. The single most important mitigating fact - not captured in the CVSS vector - is that the defect is only reachable through a DIRECT call to encode_punycode(): the documented high-level conversion functions (domain_to_ascii/email_to_ascii) first match the label against Unicode properties, and that match dies on a malformed-UTF-8 string, so ordinary IDN users are NOT exposed. This makes AV:N/PR:N technically correct at the API boundary but real exposure depends on an application choosing to feed attacker-controlled bytes straight into the low-level encoder. Net conclusion: technically a real, patchable hang/crash, but a niche low-EPSS, no-KEV, no-POC issue whose blast radius is limited by the direct-call requirement - patch on a normal cycle rather than emergency. |
| Exploit ScenarioDerived | An application uses Net::IDN::Punycode and calls encode_punycode() directly on user-supplied bytes read through a :utf8 PerlIO layer (which sets the UTF-8 flag even on malformed input). An unauthenticated attacker submits a string containing a truncated or invalid UTF-8 sequence (e.g. 'abc\xE2\x82' or 'abc\xFF'); on perl 5.32+ the XS scanner steps backward on the (STRLEN)-1 length report and loops forever, hanging the worker, while on perl 5.28+ the pure-Perl backend can crash with SIGBUS. No public exploit code has been identified, but the CPANSec test suite includes reproducing malformed-input cases. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Malformed UTF-8 passed directly to Perl's Net::IDN::Punycode encode_punycode() before version 2.590 can push the interpreter into an unending loop, abort the process, or return a Punycode label that encodes bytes the input never contained, depending on the Perl version and which backend is selected. Only code paths that call the low-level encoder itself on attacker-influenced, UTF-8-flagged byte strings are exposed, since the documented domain_to_ascii() and email_to_ascii() wrappers perform a Unicode property match first and die on such input, and the decoder is unaffected. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with an independent assessment adding I:L for the wrong-label case), EPSS is 0.16% at the 6th percentile, CISA SSVC records Exploitation: none and Automatable: yes with partial technical impact, and no public exploit is identified at time of analysis, although the upstream fix commits do include regression tests that reproduce the malformed-input condition.
RemediationAI
Upgrade the Net-IDN-Encode distribution to a build that contains the upstream fix commits 0918fb4a (XS sentinel check), 59dc7f2c, accb6df5 and 572af018, as documented in the 2.590-TRIAL changes file; vendor patch status is recorded as available, but because the published fix is delivered through GitHub commits and a TRIAL release, verify that the specific CPAN package you deploy actually includes the croak-on-malformed-UTF-8 change rather than assuming any 2.590 build does. Note the side effect of the fix: encode_punycode() now throws on malformed input instead of looping or returning a wrong label, so callers must wrap the call in eval and handle the exception, otherwise previously silent bad input becomes a fatal error. As compensating controls where upgrading is delayed: stop routing untrusted bytes into encode_punycode() directly and use the higher-level domain_to_ascii()/email_to_ascii() wrappers, accepting that they too die on malformed input; replace the :utf8 PerlIO layer with :encoding(UTF-8) (or explicitly validate with Encode::decode('UTF-8', $bytes, Encode::FB_CROAK)) so malformed sequences are rejected at read time rather than being flagged as UTF-8 and forwarded unchecked, with the trade-off that reads now fail on bad input that previously passed through; and avoid byte-to-character promotion via Encode::_utf8_on(), which is what the upstream regression tests use to construct the triggering strings. Because impact is availability-heavy with EPSS of only 0.16% and no recorded exploitation, scheduling the upgrade in a normal maintenance window is reasonable, provided any direct encoder calls are wrapped defensively in the interim.
Affected ProductsAI
The vulnerable component is Net::IDN::Punycode, shipped in the Net-IDN-Encode distribution, in all versions before 2.590, running on any Perl 5.x interpreter, with the observable failure mode varying by interpreter release - an infinite loop (XS backend) on Perl 5.32 and later, SIGBUS on Perl 5.28 and later or a panic/wrong label via the pure-Perl backend, and a wrong label for a different name on earlier Perls using the XS backend. No CPE strings were supplied with the source data, so affected copies should be identified by installed distribution version rather than by CPE matching; the maintainer's release notes for 2.590-TRIAL at https://metacpan.org/release/PJCJ/Net-IDN-Encode-2.590-TRIAL/changes and the EUVD record EUVD-2026-84295 (https://nvd.nist.gov/vuln/detail/CVE-2026-87082) document the scope. Applications that only consume the documented domain_to_ascii()/email_to_ascii() wrappers, or that only decode Punycode, are outside the affected call paths, which substantially narrows the practical install base relative to the module's raw download count.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Punycode (RFC 3492) is the encoding used to represent internationalized domain names in ASCII form within IDNA; Net::IDN::Punycode is a Perl implementation that exposes both a low-level encode_punycode() call and higher-level conversion wrappers. The defect class is CWE-835, a loop with an unreachable exit condition, rooted in a missing UTF-8 well-formedness check. Perl strings can carry the internal UTF-8 flag (SVf_UTF8) while holding bytes that are not valid UTF-8 sequences, and one of the most common ways to produce exactly that state is the :utf8 PerlIO layer, which sets the flag without validating the incoming bytes. Neither the XS (C) backend nor the pure-Perl backend validates that state before encoding. On Perl 5.32 and later, the XS backend signals a malformed sequence with a length of (STRLEN)-1, which the scan code treats as a forward stride but instead steps back one byte, so the loop never terminates; the fix commit 0918fb4a inserts an explicit check for that sentinel and croaks with 'malformed UTF-8 in input for encode_punycode'. On earlier Perls the XS backend returns a valid label for a different name, making this a silent integrity issue rather than just a denial-of-service condition. The pure-Perl backend applies a regex to the flagged string, which per the advisory either aborts with SIGBUS on Perl 5.28 and later, dies with a panic, or yields a wrong label. The documented conversion functions are shielded only incidentally: they first match the label against Unicode properties, and that match dies on malformed input, so the vulnerable path requires a direct call to encode_punycode(). The decoder is not affected.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, no auth or interaction at the encoder API and trivial trigger (AC:L); A:H for the hang/crash DoS plus I:L for the wrong-label output the input never held; C:N.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode.
Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from any malformed input, reaches the encoder unchecked. On perl 5.32 and later the XS backend reports a malformed sequence with a length of (STRLEN)-1, so the scan steps back one byte instead of forward and never ends. On earlier perls the XS returns a valid label for a different name. The pure-Perl backend runs a regex over the flagged string. Depending on the bytes, it aborts with SIGBUS on perl 5.28 and later, dies with a panic, or returns a wrong label.
The documented conversion functions match the label against Unicode properties first and that match dies on such a string, so only a direct call to encode_punycode reaches the defect. The decoder is not affected.
A direct caller encoding attacker-supplied bytes hangs, crashes or gets a label for a name the input never held.
Executive ViewAI
Perl's Net::IDN::Punycode library contains a high-severity flaw that can disrupt service availability or produce incorrect internationalized-domain output when applications call the low-level encoder directly on untrusted UTF-8 input. The exposure is limited to specific direct-encoder code paths, but affected services are unauthenticated-reachable and could be forced into loops, aborts, or wrong Punycode labels. Leadership should care because customer-facing domain or email processing services may become unavailable or return corrupted encoding results until the vendor patch is applied.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB