Security Bypass in perl-URI Package: Moderate Vulnerability Update
Summary
ALSA-2026:84590: Moderate: perl-URI security update. Affects perl-URI versions < 1.73-4.el8_10. Fixed in 1.73-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The perl-URI package is a Perl module that implements the URI class, allowing developers to work with Uniform Resource Identifier references as specified in RFC 2396 and updated by RFC 2732. This package is widely used in web applications to handle URIs effectively. However, it has been found to have a security vulnerability that could lead to unauthorized access due to improper hostname encoding.
Vulnerability Detail
The vulnerability arises from a security bypass caused by incorrect hostname encoding due to missing Unicode normalization. This flaw allows attackers to manipulate URIs in a way that could lead to unauthorized access or data leakage. The specific issue is documented under CVE-2026-19953, which outlines the potential risks associated with this vulnerability, including the ability for malicious actors to exploit the flaw to bypass security measures.
How To Fix
Minimum fixed version
1.73-4.el8_10
This is the first release that contains the fix.
sudo dnf update perl-URITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider validating and sanitizing URIs manually in your application to mitigate the risk of exploitation until the package can be updated.
Conclusion
The perl-URI package has a moderate security vulnerability that could allow unauthorized access due to incorrect hostname encoding. It is crucial to update to the patched version to mitigate risks. Regular monitoring and validation of URIs are recommended to enhance security.
See every vulnerability recorded for perl-URI →
FAQ
The vulnerability is a security bypass due to incorrect hostname encoding, which can lead to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the perl-URI package to the latest patched version using 'sudo dnf update perl-URI' to secure your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
The CVE associated with this vulnerability is CVE-2026-19953, which provides detailed information about the issue.
Related vulnerabilities
Recent vulnerabilities recorded for perl-URI.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
