Moderate Security Bypass in perl-URI Package Due to Incorrect Hostname Encoding
Summary
RLSA-2026:84587: Moderate: perl-URI security update. Affects perl-URI versions < 0:5.27-3.el10_2.1. Fixed in 0:5.27-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The perl-URI package is a Perl module that implements the URI class, allowing developers to create and manipulate Uniform Resource Identifier (URI) references as specified in RFC 2396 and updated by RFC 2732. This module is widely used in web applications and services for handling URLs and URIs effectively. However, a recent security vulnerability has been identified that affects the encoding of hostnames, potentially leading to security bypass issues.
Vulnerability Detail
The vulnerability, identified as CVE-2026-19953, arises from incorrect hostname encoding due to missing Unicode normalization in the perl-URI module. This flaw can allow attackers to bypass security measures, leading to unauthorized access or manipulation of resources. The impact of this vulnerability is significant, as it can compromise the integrity and confidentiality of applications relying on this module for URI handling. The CVSS score for this vulnerability is 7.2, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:5.27-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update perl-URITip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing additional input validation and sanitization for URIs in your application to mitigate the risk of security bypass until the package can be updated.
Conclusion
The perl-URI package has a moderate security vulnerability (CVE-2026-19953) due to incorrect hostname encoding. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for perl-URI →
FAQ
CVE-2026-19953 is a security vulnerability in the perl-URI package that allows for security bypass due to incorrect hostname encoding.
This vulnerability can lead to unauthorized access or manipulation of resources in applications that rely on the perl-URI module for URI handling.
The CVSS score for this vulnerability is 7.2, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update the package immediately, consider implementing additional input validation and sanitization for URIs in your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for perl-URI.
