Read the docs
TI-2026-16175 Aliases CVE-2026-19953GHSA-wf9v-63v3-ff2x

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode…

Priority LOW 34CWE-1289Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Partial URI: 5.36Red Hat: 7 advisoriesRed Hat: 7 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—URIbefore 5.365.36Patch availableCNA
  • URI Vendor— Affected before 5.36 Fixed in 5.36 Patch available CNA

Remediation

  • Fix · CNA URI Fixed in 5.36

Red Hat 7 advisories

  • RHSA-2026:85917 Released 2026-11-02 · Red Hat rating Moderate
    perl:5.32 security update
    • Red Hat Enterprise Linux AppStream (v. 8) perl-4:5.32.1-475.module+el8.10.0+24767+f69b15b5.aarch64::perl:5.32, perl-4:5.32.1-475.module+el8.10.0+24767+f69b15b5.ppc64le::perl:5.32, perl-4:5.32.1-475.module+el8.10.0+24767+f69b15b5.s390x::perl:5.32 +47
  • RHSA-2026:89197 Released 2026-10-27 · Red Hat rating Critical
    OpenShift Container Platform 4.22.20 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202610241758-0, rhcos-ppc64le-4.22.9.8.202610241758-0, rhcos-s390x-4.22.9.8.202610241758-0 +1
  • RHSA-2026:89907 Released 2026-10-26 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
Show 4 more Red Hat advisories
  • RHSA-2026:87400 Released 2026-10-21 · Red Hat rating Important
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:84588 Released 2026-10-19 · Red Hat rating Moderate
    perl-URI security update
    • Red Hat Enterprise Linux AppStream (v. 9) perl-URI-5.09-3.el9_8.1
  • RHSA-2026:84587 Released 2026-10-19 · Red Hat rating Moderate
    perl-URI security update
    • Red Hat Enterprise Linux AppStream (v. 10) perl-URI-5.27-3.el10_2.1
  • RHSA-2026:84590 Released 2026-10-19 · Red Hat rating Moderate
    perl-URI security update
    • Red Hat Enterprise Linux BaseOS (v. 8) perl-URI-1.73-4.el8_10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:87400
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:84587
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:85917
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:84588
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:84590
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:89197
Red Hat Update Infrastructure 5Fixed RHSA-2026:89907
Not affected: 2 products
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-19953
  2. 2026-10-03 Alias added: GHSA-wf9v-63v3-ff2x
  3. 2026-10-19 Fix available: RHSA-2026:84590 · Red Hat
  4. 2026-10-19 Fix available: RHSA-2026:84587 · Red Hat
  5. 2026-10-19 Fix available: RHSA-2026:84588 · Red Hat
  6. 2026-10-19 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  7. 2026-10-22 Fix available: RHSA-2026:87400 · Red Hat
  8. 2026-10-23 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
  9. 2026-10-29 Fix available: RHSA-2026:89197 · Red Hat
  10. 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:89907 · Red Hat
  12. 2026-10-30 Fix available: Red Hat Update Infrastructure 5 · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat
  14. 2026-11-03 Fix available: RHSA-2026:85917 · Red Hat
  15. 2026-11-03 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  16. 2026-11-06 Affected versions changed · Red Hat

References

Patch 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences