A critical CPU exhaustion vulnerability in the Perl Net::IDN::Punycode library allows unauthenticated remote attackers to cause a denial of service via specially crafted domain labels.

The library suffers from inefficient algorithmic complexity (CWE-407) where the XS and pure-Perl backends perform quadratic scans when decoding labels. An unauthenticated attacker can supply a long, malicious label that triggers excessive CPU consumption during the decoding process.

The vulnerability poses a significant risk to service availability, as an attacker can trigger a denial of service condition by sending a single crafted request. Given the CVSS score of 7.5, this high-severity flaw could lead to complete service degradation for any application relying on this library for domain name processing. Such disruptions may result in significant operational downtime and impact the reliability of network-facing services.

Immediate Action: Update the Net::IDN::Punycode library to version 2.590 or later immediately to resolve the algorithmic inefficiency.

Proactive Monitoring: Monitor server CPU utilization metrics for sudden, sustained spikes that correlate with incoming network requests or domain decoding tasks.

Compensating Controls: If immediate patching is not possible, implement strict input validation to limit the length of domain labels processed by the application before passing them to the decoder.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant risk to system availability due to the ease with which an unauthenticated actor can induce a resource exhaustion state. Administrators should prioritize updating the library to the fixed version to eliminate the underlying algorithmic flaw. Failure to patch leaves applications vulnerable to simple denial of service attacks that could effectively disable critical network-dependent infrastructure.