CVE-2026-19953

A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.

This is a pure logic bypass (CWE-1289), not a memory safety vulnerability. Successful exploitation requires a very specific, multi-condition application pattern: (1) the application accepts a URL from untrusted network input; (2) it parses the URL with URI->new(); (3) it extracts the hostname via ->host() and uses it for a security decision (e.g., SSRF filtering); and (4) it separately fetches the URL with a client that performs correct IDNA normalization. Only when all four conditions are simultaneously true can an attacker bypass the security control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.