Executive brief
The Perl URI library encodes hostnames using IDNA (Internationalized Domain Names in Applications) but fails to normalize Unicode characters before encoding them to punycode labels. This causes the same hostname to be encoded differently depending on whether its characters are pre-normalized, allowing an attacker to bypass security checks like allow/deny lists or SSRF filters by using non-standard punycode labels that differ from what actual browsers and HTTP clients would fetch.
Technical details
The vulnerability is an IDNA normalization bypass in the URI::_idna::nameprep subroutine. The function lowercased labels but omitted the Unicode NFC (Normalization Form C) required by RFC 5891 before punycode encoding. A hostname with precomposed Unicode characters (e.g., Devanagari U+0958 U+093E) would encode to a non-standard A-label (e.g., xn--72b5c) that does not round-trip and differs from the normalized form (xn--11b2fg) computed by browsers, curl, Go, Java, and Python. Code using the URI library to validate hostnames against security policies would see the non-standard label, while the actual HTTP client would resolve and fetch the NFC-normalized host, creating a mismatch. The fix applies Unicode::Normalize::NFC in nameprep and rejects non-normalized A-labels on decode.
Affected products
- Perl URI before 5.36
Timeline
- 2026-08-31: disclosed: CVE-2026-19953 published
- 2026-08-19: patched: Fix committed to repository as of commit 956619a9e94f86d8d2c529b4e06a3674c54a73e7