{"id":"CVE-2026-19953","summary":"URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep","details":"URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep.\n\nnameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label.\n\nAny caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.","modified":"2026-09-02T11:26:17.182308962Z","published":"2026-08-31T17:29:42.929Z","related":["openSUSE-SU-2026:11663-1"],"database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-1289"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19953.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/08/31/14"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19953.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/OALDERS/URI-5.36/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19953"},{"type":"REPORT","url":"https://github.com/libwww-perl/URI/pull/191"},{"type":"FIX","url":"https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch"},{"type":"PACKAGE","url":"https://github.com/libwww-perl/URI"},{"type":"ARTICLE","url":"https://www.rfc-editor.org/rfc/rfc5891#section-5.2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libwww-perl/uri","events":[{"introduced":"0"},{"fixed":"b265e58bb1ead8133eb7614b76bb7891bd96cea0"},{"fixed":"956619a9e94f86d8d2c529b4e06a3674c54a73e7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.36"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v5.35","v5.34","v5.33","v5.32","v5.31","v5.30","v5.29","v5.28","v5.27","v5.26","v5.25","v5.24","v5.23","v5.22","v5.21","v5.20","v5.19","v5.18","v5.17","v5.16","v5.15","v5.14","v5.13","v5.12","v5.11","v5.10","v5.09","v5.08","v5.07","v5.06","v5.05","v1.76","v1.75","v1.74","v1.73","v1.72","1.71","1.70_001","1.70","1.69","1.68","1.67","1.66","1.65","1.64","1.63","1.62","1.61","1.60","1.59","1.58","1.57","1.56","1.54","1.53","1.52","1.51","1.50","1.40","1.39","1.38","1.37","R1.36","R1.35","R1.34","R1.33","R1.32","R1.30","R1.29","R1.28","R1.27","R1.26","R1.25","R1.24","R1.23","R1.22","R1.21","R1.20","R1.19","R1.18","R1.17","R1.16","R1.15","R1.14","R1.12","R1.11","R1.10","R1.09","R1.08","R1.07","R1.06","R1.05","R1.03","R1.02","R1.01","R1.00","R0.90.02","R0.90.01","R0.09.02","R0.09","R5.36","R0.01","R5.22","R5.18","R5.16","B13","B11","B7","B6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19953.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}