CVE-2016-15059: Perl Net::IDN::Punycode Buffer Overflow

CVE-2016-15059 Overview

CVE-2016-15059 is a heap buffer overflow in the Net::IDN::Punycode Perl module versions before 2.301. The flaw resides in the XS backend implementation of encode_punycode, where unchecked writes past the output buffer corrupt heap memory. The XS backend allocates a scalar buffer sized from the input length, but the loop emitting digits for each code point fails to verify remaining space before writing the last digit of each round and the terminating NUL byte. Encoding an attacker-supplied string triggers the overflow. Only the XS backend is affected; the pure-Perl fallback is safe. The issue is categorized under CWE-122: Heap-based Buffer Overflow.

Critical Impact
Any Perl application that passes untrusted input to encode_punycode from the XS backend can suffer heap corruption, enabling denial of service or potential remote code execution.

Affected Products

Net::IDN::Punycode (part of Net-IDN-Encode) Perl module versions prior to 2.301
Perl applications and libraries linking the XS backend of Net::IDN::Punycode
Downstream software performing Internationalized Domain Name (IDN) encoding on untrusted input

Discovery Timeline

2026-09-22 - CVE-2016-15059 published to NVD
2026-09-22 - Last updated in NVD database
Public references - GitHub Patch Commit, MetaCPAN Release 2.301 Changes, RT Ticket #118924, and OpenWall OSS-Security Post

Technical Details for CVE-2016-15059

Vulnerability Analysis

The vulnerability lives in lib/Net/IDN/Punycode.xs, the compiled C extension that implements Punycode encoding for Perl. When encode_punycode processes an input label, it allocates a Perl scalar buffer sized from the input length and writes encoded output directly into that buffer. The digit-emission loop uses base-36 arithmetic and produces a variable number of output bytes per code point.

The loop performs a bounds check before most writes but omits the check for the final digit of each round and for the terminating NUL. Inputs whose encoded form exactly fills the allocated buffer overrun the allocation. Because writes land on the heap-backed scalar buffer, attackers can corrupt adjacent heap metadata and Perl-managed data structures.

Root Cause

The root cause is missing bounds validation in the output write path of the XS backend. The buffer size estimate assumes the encoded output will not exceed a predictable multiple of the input length, but the actual per-round output can exceed that assumption for pathological inputs. Two specific writes—the last digit of each round and the trailing NUL—execute without checking current < end.

Attack Vector

Exploitation requires an attacker to supply a crafted Unicode string that reaches encode_punycode. Common exposure points include IDN normalization in mail servers, URL parsers, DNS tooling, chat gateways, and any Perl service that converts user-supplied Unicode identifiers into ASCII-compatible encoding. No authentication or user interaction is required if the affected code path is reachable over the network.

text

   return k + (((BASE-TMIN+1) * delta) / (delta+SKEW));
 };
 
+static void
+grow_string(SV *const sv, char **start, char **current, char **end, STRLEN add)
+{
+  STRLEN len;
+
+  if(*current + add <= *end)
+    return;
+
+  len = (*current - *start + add + 15) & ~15;
+  *start = SvGROW(sv, len);
+  *current = *start + len;
+  *end = *start + SvLEN(sv);
+}
+
 MODULE = Net::IDN::Punycode PACKAGE = Net::IDN::Punycode
 
 SV*

Source: GitHub Patch Commit 9a3ba07. The patch introduces a grow_string helper that reallocates the scalar buffer via SvGROW when a pending write would exceed the current allocation, eliminating the unchecked writes.

Detection Methods for CVE-2016-15059

Indicators of Compromise

Perl interpreter crashes or SIGSEGV events in processes that call Net::IDN::Punycode::encode_punycode
Heap corruption reports from libc, malloc debuggers, or AddressSanitizer traces referencing Punycode.xs
Unusually long or high-code-point Unicode strings arriving at IDN, DNS, or email processing endpoints

Detection Strategies

Inventory installed CPAN modules and flag hosts where Net-IDN-Encode reports a version below 2.301
Instrument Perl test suites with AddressSanitizer or Valgrind to trigger the overflow on suspect inputs
Add application-layer input length and code-point range checks in front of Punycode encoding calls

Monitoring Recommendations

Monitor process exit codes and core dumps for Perl workers handling IDN, SMTP, or URL parsing
Log and alert on repeated abnormal Unicode input patterns targeting IDN encoding services
Track CPAN dependency versions in CI/CD and fail builds that pin Net-IDN-Encode below 2.301

How to Mitigate CVE-2016-15059

Immediate Actions Required

Upgrade Net-IDN-Encode to version 2.301 or later on every host running affected Perl applications
Audit code paths that call encode_punycode and restrict them to validated, length-bounded input
Temporarily force the pure-Perl backend where the XS backend cannot be updated immediately

Patch Information

The fix is included in Net-IDN-Encode version 2.301 (see MetaCPAN Release Changes). The upstream commit adds the grow_string helper in lib/Net/IDN/Punycode.xs, which calls SvGROW to expand the scalar buffer before any write that would exceed the current allocation. Details of the original report are in RT Ticket #118924.

Workarounds

Set the environment or module configuration to prefer the pure-Perl backend, which is not affected
Enforce strict input validation limiting Unicode label length before invoking Punycode encoding
Isolate affected Perl services behind sandboxing, seccomp, or reduced-privilege accounts until patched

bash

# Upgrade Net-IDN-Encode via cpanm to the fixed release
cpanm Net::IDN::Encode@2.301

# Verify the installed version
perl -MNet::IDN::Encode -e 'print $Net::IDN::Encode::VERSION, "\n"'