Skip to content
OpenAdvisories
Medium ALAS2-2026-4083 1 CVE

Moderate: perl-URI security update (Amazon Linux 2)

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-19953: URI::_idna::nameprep only lowercased the label and skipped the Unicode normalization that RFC 3490/3491 require. As a result, a host that was not already in NFC encoded to a non-standard A-label that disagrees with what browsers, curl, Go, Java, and Python compute for the same input -- and that A-label does not round-trip. Code that reads $uri->host for a security decision (allow/deny lists, SSRF filters, routing, dedup) could therefore disagree with the host that is actually fetched.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 perl-URI 0:1.60-9.amzn2.0.1

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-19953

    URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

    URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C befo…

    liburi-perl liburi-perl perl-URI Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-19953.html