CVE-2026-74766 in Net::IDN::Punycode
Summary
by MITRE • 09/22/2026
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode.
The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation.
Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected.
Decoding an attacker-supplied punycode label reads and writes freed heap memory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Net::IDN::Punycode versions ranging from 2.301 to just before 2.590 represents a critical heap-based use-after-free flaw within the Perl programming language ecosystem, specifically affecting the XS backend implementation of the punycode decoding logic. This defect was inadvertently introduced during the development cycle for CVE-2016-15059, which originally targeted different security concerns but resulted in an improper memory management sequence that persists until version 2.590. The core issue resides within the decode_punycode function, where the XS backend is responsible for inserting decoded Unicode code points into a scalar string buffer. The operational flaw stems from a race condition-like logic error in pointer management during dynamic memory reallocation. Specifically, the algorithm computes an insertion pointer based on the current state of the output buffer before determining if the buffer needs to be expanded to accommodate new data. When a decoded code point exceeds four bytes, which occurs for any Unicode character above U+FFFF, the existing buffer capacity is exceeded because the initial allocation size was calculated as twice the label length rather than accounting for potential multi-byte expansions.
This miscalculation forces the system to trigger a reallocation of the heap memory block holding the string data. During this reallocation process, the operating system or Perl runtime allocates a new, larger contiguous block of memory and copies the existing content from the old buffer to the new one. Crucially, while the main pointer referencing the start of the buffer is updated to point to this newly allocated memory region, the previously computed insertion pointer remains unchanged. This creates a dangling pointer scenario where the insertion pointer still references the address space of the now-freed original buffer block. Consequently, when the code proceeds to write the decoded character data into the intended location using this stale pointer, it performs both read and write operations on freed heap memory rather than the valid new buffer.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution or denial of service through application crashes. By decoding a maliciously crafted punycode label containing high-value Unicode characters that trigger the reallocation path, an attacker can cause the Perl interpreter to access invalid memory addresses. This use-after-free condition allows for information disclosure if the freed memory contains sensitive data from previous allocations, which might be read before being overwritten or during the write operation itself. More critically, it enables heap corruption attacks where an attacker can manipulate adjacent memory structures within the Perl runtime environment. Such manipulation can lead to control flow hijacking, allowing remote code execution with the privileges of the process running the vulnerable script. This is particularly dangerous in server-side applications that parse internationalized domain names from user input or network traffic without strict validation prior to decoding.
From a classification perspective, this vulnerability aligns closely with CWE-416, Use After Free, as it involves referencing memory after it has been freed by another part of the program. It also relates to CWE-787, Out-of-bounds Write, because the write operation targets an invalid address resulting from incorrect pointer arithmetic relative to buffer reallocation events. In terms of adversary tactics, this flaw facilitates exploitation techniques categorized under ATT&CK T1059, Command and Scripting Interpreter, as Perl is often used for system administration tasks where successful exploitation could lead to full host compromise. The vulnerability highlights the risks associated with low-level memory management in XS modules, which bridge C code with Perl's garbage collection mechanisms without automatic safety checks against pointer invalidation during reallocation events.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Organizations utilizing Net::IDN::Punycode should upgrade to version 2.590 or later, where this specific memory management defect has been resolved by ensuring that insertion pointers are recalculated after any buffer reallocation occurs. For environments where upgrading is not immediately feasible, input validation serves as a secondary control layer. Developers can implement pre-decoding checks to ensure that the resulting Unicode string length will fit within the initially allocated buffer size or manually manage memory allocation with sufficient headroom for multi-byte characters. Additionally, enabling Perl's taint mode and using static analysis tools designed to detect XS memory errors can help identify similar patterns in custom codebases. Regular auditing of third-party CPAN modules is essential given that such low-level vulnerabilities often remain undetected until exploited in the wild by attackers targeting internationalization processing pipelines.