URI Perl Library Vulnerability in Non-NFC Host Name Encoding

CVE-2026-19953

What is CVE-2026-19953?

The URI library for Perl prior to version 5.36 contains a significant vulnerability related to the encoding of non-NFC (Normalization Form C) host names. This issue arises from the library's inability to perform proper Unicode normalization during the nameprep phase, which results in the production of non-standard punycode labels. When security decisions are made based on host labels derived from user input, discrepancies can occur between the label used for security checks and the label resolved by the client. This inconsistency poses risks such as unauthorized access and security bypasses, especially for applications relying on host validation mechanisms.

References