diff --git a/src/Hostname.php b/src/Hostname.php
index b9e0bdf6..7dbf073d 100644
--- a/src/Hostname.php
+++ b/src/Hostname.php
@@ -2212,6 +2212,10 @@ protected function decodePunycode($encoded)
 
         for ($indexe = $separator ? $separator + 1 : 0; $indexe < $lengthe; ++$lengthd) {
             for ($oldIndex = $index, $pos = 1, $key = 36; 1; $key += 36) {
+                if (! isset($encoded[$indexe])) {
+                    break 2;
+                }
+
                 $hex   = ord($encoded[$indexe++]);
                 $digit = $hex - 48 < 10 ? $hex - 22
                        : ($hex - 65 < 26 ? $hex - 65
diff --git a/test/HostnameTest.php b/test/HostnameTest.php
index 48265561..6814e8d4 100644
--- a/test/HostnameTest.php
+++ b/test/HostnameTest.php
@@ -685,4 +685,14 @@ public function testHostnameWithEmptyDomainPart(): void
     {
         self::assertFalse($this->validator->isValid('.com'));
     }
+
+    public function testInvalidHostnameWithPunyEncodedDomainPart(): void
+    {
+        self::assertFalse($this->validator->isValid('xn--k.dk'));
+    }
+
+    public function testValidHostnameWithPunyEncodedDomainPart(): void
+    {
+        self::assertTrue($this->validator->isValid('xn--gld-sna.de'));
+    }
 }