Bug 2538895 (CVE-2026-74765)

Summary: CVE-2026-74765 perl-Net-IDN-Encode: Net::IDN::Punycode: Information disclosure or denial of service via integer overflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Net::IDN::Punycode. An integer overflow vulnerability in the `encode_punycode` function, specifically within the XS backend, allows a remote attacker to cause an out-of-bounds read. By supplying a specially crafted string, an attacker can trigger the overflow, leading to either the disclosure of sensitive information or a denial of service by crashing the process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2542490    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 21:06:28 UTC 
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode.

The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow check, so a large enough code point wraps the delta and the digit index leaves the range of the 36-entry digit table. The bound before the final table access tests only for an index above 36, so a negative index passes it, as does 36 itself. Perl strings hold code points beyond the Unicode range, and one such code point overflows the accumulation on its own. Valid input wraps it as well, for example 1927 ASCII letters followed by U+10FFFF. The conversion functions encode a label before they check its length, so a long label reaches the encoder through the documented API.

Only the XS backend is affected.

Encoding an attacker-supplied string copies a byte from outside the digit table into the encoded result or crashes the process.