The Net::IDN::Punycode Perl module versions prior to 2.590 have an integer overflow vulnerability in the XS backend's encode_punycode function. The vulnerability occurs because the delta accumulator and digit index are stored in a signed int without overflow checks. When encoding certain inputs, such as a long label with a high Unicode code point (e.g., U+10FFFF), the delta value can overflow and wrap around, causing the digit index to go out of the valid range of the 36-entry digit table. The bounds check only tests for indices above 36, allowing negative indices or 36 itself to pass, resulting in an out-of-bounds read. This can lead to copying bytes from outside the digit table into the encoded result or crashing the process. The vulnerability is limited to the XS backend implementation.

An attacker can supply specially crafted strings that trigger the integer overflow and out-of-bounds read in the encode_punycode function. This may cause the process to crash or potentially lead to memory corruption by reading bytes outside the intended digit table. There is no indication of known exploits in the wild. The vulnerability affects only the XS backend of the module.

A fixed version 2.590 or later should be used to remediate this vulnerability. Since no patch links are provided, users should check the official Net::IDN::Punycode module repository or CPAN for updates. Until patched, avoid processing untrusted input with the XS backend or disable it if possible.