Red Hat Security Advisory

RHSA-2026:84587

perl-URI security update

Released 2026-10-19 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2026-16175 CVE-2026-19953 · GHSA-wf9v-63v3-ff2x

LOW 34

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00229 Published 2026-08-31 Partial fix · 5.36 CWE-1289