Threats affecting pkg:cpan/Net-IDN-Encode

Net::IDN::Punycode versions before 2.590 for Perl contain a vulnerability in the encode_punycode function where malformed UTF-8 input can cause the process to hang, crash, or return incorrect labels. This occurs because the function does not validate that its input is well-formed UTF-8, leading to infinite loops or crashes depending on the Perl version and backend used. The issue affects direct calls to encode_punycode with attacker-supplied bytes; the decoder and documented conversion functions are not affected.

CVE-2026-87081 is a vulnerability in Net::IDN::UTS46 versions before 2.590 for Perl that allows CPU exhaustion via inefficient algorithmic complexity in punycode encoding. The flaw arises because the to_ascii function punycode encodes each label before applying the 63-byte DNS length limit, leading to quadratic time complexity when processing labels with many distinct non-ASCII characters. This can cause denial of service by exhausting CPU resources during encoding operations.

CVE-2026-87080 affects Net::IDN::Punycode::PP versions before 2.590 for Perl. The vulnerability arises from improper validation of syntactic correctness when decoding truncated labels, causing the pure-Perl decoder to produce a name containing characters it never encoded. This discrepancy between the pure-Perl and XS backends can lead to inconsistent resolution of domain labels.

CVE-2026-87079 is a high-severity vulnerability in Net::IDN::Punycode versions before 2.590 for Perl. It allows an attacker to cause CPU exhaustion due to inefficient quadratic-time processing when decoding long labels in the decode_punycode function. The vulnerability arises because the XS backend scans the UTF-8 buffer from the start for each code point insertion, and the pure-Perl backend similarly incurs quadratic cost when handling UTF-8 flagged input. There is no length bound on labels when converting to Unicode, enabling attackers to supply arbitrarily long labels to trigger this behavior.

CVE-2026-87078 is a critical memory leak vulnerability in Net::IDN::Punycode Perl module versions from 2.302 up to but not including 2.590. The issue occurs in the XS backend during the decode_punycode function, where output buffers are allocated before input validation and only released on successful decoding. Invalid labels cause the buffers to remain allocated, leading to unbounded memory growth proportional to twice the label length per rejected call. This affects only the XS backend implementation.

Net::IDN::Punycode versions from 2.301 up to but not including 2.590 for Perl contain a heap use-after-free vulnerability in the XS backend's decode_punycode function. This flaw arises when decoding certain punycode labels with code points above U+FFFF, causing the output buffer to reallocate without updating all pointers, leading to use of freed memory. This vulnerability allows reading and writing of freed heap memory, potentially resulting in high impact on confidentiality, integrity, and availability.

Net::IDN::Punycode versions before 2.590 for Perl contain an integer overflow vulnerability in the XS backend's encode_punycode function. This overflow occurs due to lack of checks on the delta accumulator during encoding, allowing out-of-bounds reads from the digit table. An attacker can supply crafted input that causes the process to crash or copy unintended bytes into the encoded output. The vulnerability has a medium severity with a CVSS score of 6.5.