CVE-2026-19953
- ULN >
- Oracle Linux CVE repository >
- CVE-2026-19953
CVE Details
| Release Date: | 2026-08-31 | |
| Impact: | Moderate | What is this? |
Description
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.
See more information about CVE-2026-19953 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 7.2 |
| Vector String: | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| Version: | 3.1 |
| Attack Vector: | Network |
| Attack Complexity: | Low |
| Privileges Required: | None |
| User Interaction: | None |
| Scope: | Changed |
| Confidentiality Impact: | Low |
| Integrity Impact: | Low |
| Availability Impact: | None |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 10 (perl-URI) | ELSA-2026-84587 | 2026-10-19 |
| Oracle Linux version 8 (perl) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Algorithm-Diff) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Archive-Tar) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Archive-Zip) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-CPAN) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-CPAN-DistnameInfo) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-CPAN-Meta) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-CPAN-Meta-Requirements) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-CPAN-Meta-YAML) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Carp) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Compress-Bzip2) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Compress-Raw-Bzip2) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Compress-Raw-Lzma) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Compress-Raw-Zlib) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Config-Perl-V) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-DB_File) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Data-Dumper) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Data-OptList) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Data-Section) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Devel-PPPort) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Devel-Size) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Digest) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Digest-MD5) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Digest-SHA) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Encode) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Encode-Locale) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Env) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Exporter) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-ExtUtils-CBuilder) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-ExtUtils-Install) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-ExtUtils-MakeMaker) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-ExtUtils-Manifest) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-ExtUtils-ParseXS) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Fedora-VSP) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-File-Fetch) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-File-HomeDir) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-File-Path) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-File-Temp) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-File-Which) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Filter) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Filter-Simple) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Getopt-Long) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-HTTP-Tiny) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IO-Compress) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IO-Compress-Lzma) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IO-Socket-IP) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IPC-Cmd) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IPC-SysV) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-IPC-System-Simple) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Importer) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-JSON-PP) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Locale-Maketext) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-MIME-Base64) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-MRO-Compat) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Math-BigInt) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Math-BigInt-FastCalc) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Math-BigRat) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Module-Build) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Module-CoreList) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Module-Load) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Module-Load-Conditional) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Module-Metadata) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Object-HashBase) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Package-Generator) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Params-Check) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Params-Util) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-PathTools) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Perl-OSType) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-PerlIO-via-QuotedPrint) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Checker) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Escapes) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Parser) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Perldoc) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Simple) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Pod-Usage) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Scalar-List-Utils) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Socket) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Software-License) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Storable) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Sub-Exporter) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Sub-Install) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Sys-Syslog) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Term-ANSIColor) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Term-Cap) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Term-Table) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Test-Harness) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Test-Simple) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-Balanced) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-Diff) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-Glob) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-ParseWords) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-Tabs+Wrap) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Text-Template) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Thread-Queue) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Time-HiRes) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Time-Local) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-URI) | ELSA-2026-84590 | 2026-10-19 |
| Oracle Linux version 8 (perl-URI) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Unicode-Collate) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-Unicode-Normalize) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-autodie) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-bignum) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-constant) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-experimental) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-generators) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-inc-latest) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-libnet) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-local-lib) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-parent) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-perlfaq) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-podlators) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-threads) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-threads-shared) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 8 (perl-version) | ELSA-2026-85917 | 2026-10-23 |
| Oracle Linux version 9 (perl-URI) | ELSA-2026-84588 | 2026-10-19 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
