CVE-2026-74765: Perl Net::IDN::Punycode Buffer Overflow

CVE-2026-74765 Overview

CVE-2026-74765 affects Net::IDN::Punycode versions before 2.590 for Perl. The vulnerability is an out-of-bounds read triggered by an integer overflow of the delta accumulator in the encode_punycode routine. Only the XS backend is affected. An attacker who supplies a crafted string to the encoder can cause the process to copy a byte from outside the 36-entry digit table into the encoded result, or crash the process. The flaw is classified under [CWE-125] (Out-of-Bounds Read) and impacts Perl applications that pass untrusted input through Internationalized Domain Name (IDN) encoding.

Critical Impact
Attacker-supplied strings passed to the XS punycode encoder can leak adjacent memory into encoded output or crash the Perl process, affecting any application handling untrusted domain labels.

Affected Products

Net::IDN::Punycode (Perl) versions before 2.590
Net-IDN-Encode distribution, XS backend only
Perl applications performing IDN encoding on untrusted input

Discovery Timeline

2026-09-22 - CVE CVE-2026-74765 published to NVD
2026-09-22 - Public discussion on OpenWall OSS-Security
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-74765

Vulnerability Analysis

The XS backend of Net::IDN::Punycode stores the punycode delta and the derived digit index in a signed int. During encoding, the accumulation delta += (m-n) * (h+1) executes without an overflow check. A sufficiently large code point wraps the signed integer, producing a negative delta and, consequently, a negative or out-of-range digit index. The bound test before the final enc_digit[q] array access only rejects indices greater than 36. A negative index or the value 36 itself passes the check, allowing a read outside the 36-entry digit table.

Root Cause

Perl strings hold code points beyond the Unicode range (U+10FFFF). A single such code point can overflow the accumulator on its own. Valid Unicode input can also trigger the wrap, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before checking its length, so long labels reach the vulnerable encoder through the documented API. The pure-Perl backend is not affected because it does not share the signed-int arithmetic path.

Attack Vector

Exploitation requires only that an application pass an attacker-controlled string to the punycode encoder. This is common in software that processes email addresses, URLs, or hostnames from network input. Successful exploitation reads a byte from memory adjacent to the enc_digit table into the output string, leaking information, or causes the Perl interpreter to crash. The following patch adds the missing overflow guards.

/* increase delta to the state corresponding to
   the m code point at the beginning of the string */
if(m - n > (UV)((PERL_INT_MAX - delta) / (h+1)))
  croak("input exceeds punycode limit");
delta += (m-n) * (h+1);
n = m;

/* now find the chars to be encoded in this round */

if(skip_delta > PERL_INT_MAX - delta)
  croak("input exceeds punycode limit");
delta += skip_delta;
for(in_p = skip_p; in_p < in_e;) {
  c = utf8_to_uvchr_buf((U8*)in_p, (U8*)in_e, &u8);
  c = NATIVE_TO_UNI(c);

  if(c < n) {
    if(delta == PERL_INT_MAX) croak("input exceeds punycode limit");
    ++delta;
  }

Source: GitHub Commit Patch #27a91cc

Detection Methods for CVE-2026-74765

Indicators of Compromise

Unexpected crashes or SIGSEGV signals in Perl processes that call Net::IDN::Punycode::encode_punycode or Net::IDN::Encode::domain_to_ascii.
Encoded output containing non-digit bytes where a punycode digit is expected, indicating a read past the enc_digit table.
Log entries containing punycode input with unusually long ASCII prefixes followed by high code points such as U+10FFFF.

Detection Strategies

Inventory Perl environments and enumerate installed Net-IDN-Encode versions with cpan -D Net::IDN::Encode or perl -MNet::IDN::Encode -e 'print $Net::IDN::Encode::VERSION'.
Add input length and code-point range validation upstream of any call to the punycode encoder, and log rejections.
Instrument fuzzing of application entry points that reach the encoder to surface crashes prior to production exposure.

Monitoring Recommendations

Monitor application error logs for the string input exceeds punycode limit, which the patched version emits when the guard trips.
Alert on repeated Perl process crashes originating from IDN or email address parsing code paths.
Track outbound data flows from services that encode user-supplied labels to detect anomalous encoded payloads.

How to Mitigate CVE-2026-74765

Immediate Actions Required

Upgrade Net-IDN-Encode to version 2.590 or later on all systems that run Perl code performing IDN encoding.
Audit application code for calls to encode_punycode, domain_to_ascii, and related APIs that accept untrusted input.
Restrict input length and reject code points above U+10FFFF before invoking the encoder as a defense-in-depth measure.

Patch Information

The fix is available in Net-IDN-Encode 2.590. Three commits address the issue: GitHub Commit Patch #27a91cc adds overflow checks on delta accumulation, GitHub Commit Patch #81c7f99 enforces the RFC 3492 limit PUNYCODE_MAXINT for counters, and GitHub Commit Patch #89d5aa8 replaces an assertion with a runtime croak guarding the enc_digit[q] read. See the Metacpan Changes for Net-IDN-Encode and RFC 3492 Section 6.4 for background.

Workarounds

Force the pure-Perl backend by setting $Net::IDN::Punycode::_NO_XS = 1 before loading the module, which avoids the vulnerable XS path.
Enforce a maximum label length below the punycode counter limit at the application boundary before calling any encoder.
Reject strings containing code points outside the valid Unicode range (greater than U+10FFFF) at input validation.

bash

# Upgrade to the patched release
cpanm Net::IDN::Encode@2.590

# Verify the installed version
perl -MNet::IDN::Encode -E 'say $Net::IDN::Encode::VERSION'