CVE-2026-19953
Description
A flaw was found in the URI component for Perl. This vulnerability occurs because the nameprep function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.
Statement
This is a pure logic bypass (CWE-1289), not a memory safety vulnerability. Successful exploitation requires a very specific, multi-condition application pattern: (1) the application accepts a URL from untrusted network input; (2) it parses the URL with URI->new(); (3) it extracts the hostname via ->host() and uses it for a security decision (e.g., SSRF filtering); and (4) it separately fetches the URL with a client that performs correct IDNA normalization. Only when all four conditions are simultaneously true can an attacker bypass the security control.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.2 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
