The vulnerability arises in the XS backend of the Net::IDN::Punycode Perl module, where the output scalar is allocated before input validation. A rejected label results in memory allocation that is never freed, leaking twice the label length per call. Repeated injections of invalid labels can cause state‑ful memory bloat and eventually a denial‑of‑service. The weakness is CWE‑401, a memory leak, and it has no immediate impact on data confidentiality or integrity.

The affected software is the Net::IDN::Punycode Perl module, only the XS backend. Versions from 2.302 up to but not including 2.590 are vulnerable. The recommended fix is to upgrade to Net-IDN-Encode 2.590‑TRIAL or later, which replaces the defective XS implementation.

Because no authentication or privilege escalation is required, the attack vector is to supply crafted domain labels to any path that calls decode_punycode. Each failure allocates memory that remains resident, so a hostile user can trigger repeated memory growth that may exhaust system resources. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, and with a CVSS score of 9.1 the lack of defensive bounds makes it a high‑impact denial‑of‑service risk in exposed services.