The Net::IDN::Punycode Perl module contains a resource exhaustion flaw. When decoding a long domain label, the backend inserts each decoded code point into a UTF‑8 buffer while scanning from the start of the buffer each time. This leads to a quadratic time complexity in the label length, so an attacker can trigger a severe CPU spike by providing an excessively long label. The pure‑Perl variant behaves similarly because it copies the input before downgrading to bytes, causing the same scan‑from‑start overhead. There is no upper bound enforced on the label length for Unicode conversion, so any input supplied to domain_to_unicode or uts46_to_unicode can trigger the issue.

The vulnerability affects the Net::IDN::Punycode Perl module, versions prior to 2.590, which is distributed via CPAN. Any Perl application that incorporates this module and performs domain name to‑Unicode conversion is potentially subject to the flaw.

The defect provides a denial‑of‑service path through CPU exhaustion; it requires the attacker to supply a long label to a system using the vulnerable module, typically via domain name handling in web or DNS‑looking‑up code. The CVSS score is 7.5, the EPSS score is < 1%, and it is not listed in CISA KEV. The lack of a bound on label length means an attacker can force arbitrary CPU load against the process, potentially impacting availability and business continuity in a Perl application.