Skip to content
Fencer Vulns
medium 6.5

CVE-2026-19953 json

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

published 2026-08-31 2 mo ago modified 2026-09-03 2 mo ago also EUVD-2026-68681

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep.

nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label.

Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

Patch / fix

  • liburi-perl Debian 14 5.36-1

debian advisories DEBIAN-CVE-2026-19953

  • perl-URI RHEL 8 1.73-4.el8_10
  • perl-URI RHEL 10.2 5.27-3.el10_2.1
  • perl-URI RHEL 9 5.09-3.el9_8.1

red hat advisories RHSA-2026:84590RHSA-2026:84587RHSA-2026:84588

  • perl-URI SLE Module for Basesystem 15 SP7 1.73-150000.3.3.1
  • perl-URI SLES for SAP applications 16.0, SLES 16.0 5.310.0-160000.3.1
  • perl-URI SLES LTSS Extended Security 12 SP5 1.60-9.3.1

suse advisories SUSE-SU-2026:4070-1SUSE-SU-2026:4046-1SUSE-SU-2026:23633-1

  • perl-URI openSUSE Leap 16.0 5.310.0-160000.3.1
  • perl-URI openSUSE Tumbleweed 5.360.0-1.1

opensuse advisories openSUSE-SU-2026:21773-1openSUSE-SU-2026:11663-1

  • perl AlmaLinux 8 4:5.32.1-475.module_el8.10.0+4278+b5f6cf5f
  • perl-B AlmaLinux 8 1.80-475.module_el8.10.0+4278+b5f6cf5f
  • perl-if AlmaLinux 8 0.60.800-475.module_el8.10.0+4278+b5f6cf5f
  • perl-IO AlmaLinux 8 1.43-475.module_el8.10.0+4278+b5f6cf5f
  • perl-ph AlmaLinux 8 5.32.1-475.module_el8.10.0+4278+b5f6cf5f
  • perl-Env AlmaLinux 8 1.04-396.module_el8.6.0+2766+8bf0b7ce
  • perl-lib AlmaLinux 8 0.65-475.module_el8.10.0+4278+b5f6cf5f
  • perl-mro AlmaLinux 8 1.23-475.module_el8.10.0+4278+b5f6cf5f

almalinux advisories ALSA-2026:85917ALSA-2026:84587ALSA-2026:84588ALSA-2026:84590

  • perl Rocky Linux 8 4:5.32.1-475.module+el8.10.0+40316+ee3cfc74
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+1616+0d20cc68
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+878+f93dfff7
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+882+2fa1e48f
  • perl-URI Rocky Linux 8 1.76-6.module+el8.10.0+40388+02f653e8
  • perl-Carp Rocky Linux 8 1.50-439.module+el8.10.0+1616+0d20cc68
  • perl-Carp Rocky Linux 8 1.50-439.module+el8.10.0+40155+64ce2d41

rocky linux advisories RLSA-2026:85917RLSA-2026:84587RLSA-2026:84588RLSA-2026:84590

  • perl-URI Azure Linux 3.0 5.21-3

azure linux advisories AZL-98562

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-19953 updated cvss 7.2

URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization

  • Red Hat Enterprise Linux 6 perl-URI Red Hat Enterprise Linux 7 perl-URI Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9
    under investigation
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1792605272
    fixed: vendor fix RHSA-2026:87400
  • Red Hat Enterprise Linux AppStream (v. 8) perl 5.32.1-475.module+el8.10.0+24767+f69b15b5, perl-B 1.80-475.module+el8.10.0+24767+f69b15b5, perl-URI 1.76-6.module+el8.10.0+25085+1c0ca452, perl-CPAN 2.28-5.module+el8.10.0+21354+3ad137bb, perl-IO 1.43-475.module+el8.10.0+24767+f69b15b5, perl-Tie 4.6-475.module+el8.10.0+24767+f69b15b5, +213 more
    fixed: vendor fix RHSA-2026:85917
  • Red Hat Enterprise Linux AppStream (v. 9) perl-URI 5.09-3.el9_8.1
    fixed: vendor fix RHSA-2026:84588
  • Red Hat Enterprise Linux AppStream (v. 10) perl-URI 5.27-3.el10_2.1
    fixed: vendor fix RHSA-2026:84587
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-URI 1.73-4.el8_10
    fixed: vendor fix RHSA-2026:84590
  • Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202610241758
    fixed: vendor fix RHSA-2026:89197
show 2 more
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9 1793005812
    fixed: vendor fix RHSA-2026:89907
  • Red Hat Hardened Images perl-URI Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1793005764, rhui5/haproxy-rhel9 1793004999, rhui5/installer-rhel9 1793004989, rhui5/cds-kubernetes-rhel9 1793005771
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Classification

Weakness
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.