https://bugzilla.redhat.com/show_bug.cgi?id=2542490
Bug ID: 2542490
Summary: CVE-2026-74765 perl-Net-IDN-Encode:
Net::IDN::Punycode: Information disclosure or denial
of service via integer overflow [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["261de582-7308-421a-a92f-f46d9c7e61a5"]}
Component: perl-Net-IDN-Encode
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2538895 (CVE-2026-74765)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read
via integer overflow of the delta accumulator in encode_punycode.
The XS backend keeps the punycode delta, and the digit index derived from it,
in a signed int. The accumulation `delta += (m-n) * (h+1)` has no overflow
check, so a large enough code point wraps the delta and the digit index leaves
the range of the 36-entry digit table. The bound before the final table access
tests only for an index above 36, so a negative index passes it, as does 36
itself. Perl strings hold code points beyond the Unicode range, and one such
code point overflows the accumulation on its own. Valid input wraps it as well,
for example 1927 ASCII letters followed by U+10FFFF. The conversion functions
encode a label before they check its length, so a long label reaches the
encoder through the documented API.
Only the XS backend is affected.
Encoding an attacker-supplied string copies a byte from outside the digit table
into the encoded result or crashes the process.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2538895
[Bug 2538895] CVE-2026-74765 Net::IDN::Punycode: Net::IDN::Punycode:
Information disclosure or denial of service via integer overflow
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2542490
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202542490%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
