CVE-2026-87078
Description
A memory leak flaw was found in the XS backend of the Perl Net::IDN::Punycode module (part of the Net-IDN-Encode distribution). The decode_punycode function allocates a scalar output buffer before validating the Punycode input. The buffer is released only on the success path, so each of the three croak paths that reject an invalid label leaks the buffer and its allocation. Since no bound is placed on the label length in the to-Unicode direction, an attacker supplying invalid labels can grow the process memory by twice the label length per rejected call, leading to resource exhaustion and denial of service.
Statement
A memory leak flaw was found in the XS backend of the Perl Net::IDN::Punycode module (part of the Net-IDN-Encode distribution). The decode_punycode function allocates a scalar output buffer sized at twice the input length before validating the Punycode input. The buffer is released only on the success path — each of the three croak paths that reject an invalid label leaks the buffer and its allocation. Since no bound is placed on the label length in the to-Unicode direction (the 63-byte DNS limit is checked only when converting to ASCII), an attacker supplying invalid labels can grow the process memory by twice the label length per rejected call, with no successful call required. Only the XS backend is affected. This issue does not affect any Red Hat product. The perl-Net-IDN-Encode package is available only in Fedora and EPEL community repositories.
Mitigation
Upgrade to a patched version >= 2.590.
Use the pure-Perl backend of Net::IDN::Punycode instead of the XS backend. The pure-Perl backend is not affected by this memory leak. Alternatively, validate and reject Punycode labels exceeding 63 bytes at the application boundary before passing them to decode_punycode.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
