AI analysis
Net::IDN::UTS46, a Perl library implementing IDNA/UTS #46 domain-name processing, performs punycode encoding of a DNS label before enforcing the 63-byte length limit in its to_ascii function. The encoding follows the RFC 3492 sample implementation, whose cost grows with the square of a label's length when the label contains many distinct non-ASCII code points, so a single crafted overlong label can consume excessive CPU before being rejected. An attacker triggers this by supplying a hostile hostname or email address to any application that passes untrusted input through to_ascii, domain_to_ascii, or email_to_ascii (all ASCII-conversion entry points in the distribution use to_ascii). The impact is denial of service — CPU exhaustion on the process or worker handling the request — with no data exposure or code execution. No public proof of concept is known, the issue is not in the CISA KEV catalog, and no exploitation has been reported.
What to do: Upgrade to Net::IDN::UTS46 version 2.590 or later, which applies the length check before punycode encoding. Until patched, add a pre-validation layer that rejects any label longer than 63 bytes (or caps overall domain/email length) before it reaches to_ascii, domain_to_ascii, or email_to_ascii. Audit Perl applications that accept user-supplied hostnames or email addresses — such as form validators, mail handlers, and WHOIS/URL-processing tools — since all of them inherit this code path.
Affected
| Perl CPAN (Net::IDN::UTS46 distribution) Net::IDN::UTS46 | before 2.590 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. to_ascii punycode encodes each label and only then applies the 63-byte DNS limit. encode_punycode in both backends follows the sample implementation in RFC 3492, whose outer loop runs once per distinct non-ASCII code point and scans the whole input each round, so a label of distinct non-ASCII characters costs the square of its length before the limit rejects it. Every ASCII conversion in the distribution, including domain_to_ascii and email_to_ascii, goes through to_ascii.