The Net::IDN::Encode module for Perl does not validate UTF-8 input when encoding Punycode. Malformed UTF-8 can cause the encoder to hang, crash, or produce an incorrect label, resulting in denial of service or integrity problems for applications that rely on correct domain name handling. The weakness involves unchecked string handling and unsafe low‑level memory operations.

Any Perl application that uses Net::IDN::Encode prior to version 2.590 is impacted. This CPAN module is commonly included in web frameworks, mail libraries, and other Perl tools that process internationalized domain names. The decoder function is not affected, and versions 2.590 and later contain the fix.

The CVSS score is 7.5, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. Because encode_punycode can be invoked with user‑supplied data, an attacker who can influence that call can trigger a crash or hang. No publicly reported exploit exists, but the lack of a recent update does not reduce the potential for a denial of service.