The Perl Net::IDN::Punycode library contains a critical memory leak vulnerability that can be exploited by unauthenticated remote attackers to cause a denial of service.

The XS backend fails to release memory buffers when input validation fails in the decode_punycode function, allowing an attacker to trigger repeated memory allocations. This is an unauthenticated vulnerability where the attacker simply supplies invalid labels to induce a resource exhaustion state.

The vulnerability carries a CVSS score of 9.1, reflecting its high potential for system disruption. Because the memory leak occurs on every rejected call, an attacker can rapidly exhaust available system memory, leading to application crashes or service unavailability. This poses a significant risk to the stability of any infrastructure relying on this library for domain name processing.

Immediate Action: Update the Net::IDN::Punycode library to version 2.590 or later to ensure the memory management flaw is resolved.

Proactive Monitoring: Monitor server memory usage and application process logs for abnormal growth or frequent crashes that may indicate exploitation attempts.

Compensating Controls: If immediate patching is not possible, implement strict input validation at the application level to reject malformed labels before they reach the vulnerable decode_punycode function.

Public Exploit Available: Unknown

Given the critical CVSS severity and the ease with which this vulnerability can be triggered, administrators should prioritize updating to version 2.590 immediately. Failure to address this flaw leaves systems vulnerable to trivial denial-of-service attacks that can impact core business operations.