CVE-2026-19953
Received Received - Intake

URI 5.36 Host Label Non-NFC Punycode Encoding Issue

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: CPANSec

Description
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-19953
EUVD
EUVD-2026-68681

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libwww-perl uri to 5.36 (exc)
perl perl 5.36

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1289 The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Perl URI module versions before 5.36. It involves improper handling of non-NFC Unicode host names in IDNA encoding. The nameprep function lowercases labels but fails to normalize them to NFC form as required by RFC 5891. This causes non-standard punycode labels that do not match other IDNA implementations like browsers or curl.

Detection Guidance

Check if your Perl URI module version is below 5.36. Run: perl -MURI -e 'print $URI::VERSION' to verify. Inspect Perl applications using URI for IDNA handling in domain names. Look for discrepancies between host extraction and actual host resolution in logs or security tools.

Impact Analysis

The vulnerability can lead to security decisions being made incorrectly. For example, if a system uses the URI module to extract a host for allow/deny lists or SSRF filters, it may see a different host than what is actually fetched. This mismatch can cause false positives or negatives in security checks.

Mitigation Strategies

Upgrade the Perl URI module to version 5.36 or later. Update Perl applications using URI to ensure Unicode NFC normalization is applied in IDNA handling. Review security filters (SSRF, allow/deny lists) for consistency with normalized hostnames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart