Moderate Security Update for perl-URI: Bypass Due to Incorrect Hostname Encoding
Summary
ALSA-2026:84588: Moderate: perl-URI security update. Affects perl-URI versions < 5.09-3.el9_8.1. Fixed in 5.09-3.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-URI is a module that implements the URI class, allowing for the representation of Uniform Resource Identifier references as specified in RFC 2396 and updated by RFC 2732. This module is widely used in Perl applications for handling URIs, making it essential for web-related functionalities. The vulnerability in question arises from a flaw in hostname encoding, which can lead to security bypasses.
Vulnerability Detail
The vulnerability, identified as CVE-2026-19953, stems from incorrect hostname encoding due to missing Unicode normalization in the perl-URI module. This flaw allows attackers to craft URIs that could bypass security measures, potentially leading to unauthorized access or manipulation of resources. The impact of this vulnerability can be significant, especially in applications that rely on proper URI handling for security.
How To Fix
Minimum fixed version
5.09-3.el9_8.1
This is the first release that contains the fix.
sudo dnf update perl-URITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The perl-URI module has a moderate security vulnerability that could lead to security bypasses due to incorrect hostname encoding. It is essential to update to the patched version to mitigate risks. Monitoring tools like Vulert can assist in keeping your application secure.
See every vulnerability recorded for perl-URI →
FAQ
CVE-2026-19953 is the identifier for the security vulnerability in the perl-URI module, which allows for security bypass due to incorrect hostname encoding.
If your application uses the perl-URI module, it may be susceptible to unauthorized access or manipulation of resources due to this vulnerability.
While there are no specific workarounds, it is crucial to monitor your application for any unusual behavior and plan to update as soon as possible.
More details can be found on the CVE page for CVE-2026-19953, which provides insights into the impact and technical aspects of the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for perl-URI.
