The vulnerability arises in Net::IDN::UTS46 implementations prior to version 2.590 for Perl, wherein the punycode encoder performs a quadratic number of operations for every distinct non‑ASCII character before applying the 63‑byte DNS label limit. A crafted domain label that contains many unique non‑ASCII characters can cause the to_ascii routine to consume overwhelming CPU time, leading to a denial of service. The weakness is identified as CWE‑407, which describes improper resource management.

Any Perl deployment that uses Net::IDN::UTS46 or the Net-IDN-Encode distribution before the 2.590‑TRIAL release is susceptible. This includes scripts, web applications, or mail handlers that perform domain or email address normalization through domain_to_ascii or email_to_ascii.

The exploit requires an attacker to supply a domain name containing a long, non‑ASCII label that triggers the expensive punycode loop. Because the vulnerability is in a library, the attack vector is local to the application using the library; no network control is advertised for remote exploitation. The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a low likelihood of exploitation; the vulnerability is not listed in CISA's KEV catalog, implying it is not yet a widely observed threat. Nevertheless, the potential for CPU exhaustion can impact availability for any affected service, so any deployment using the vulnerable library should consider remediation promptly.