CVE-2026-19953: Perl URI SSRF Vulnerability

CVE-2026-19953 Overview

CVE-2026-19953 affects the Perl URI module in versions before 5.36. The module encodes non-NFC host names to non-standard punycode labels because nameprep performs lowercasing but skips Unicode normalization. RFC 5891 requires labels to be normalized to Form C before IDNA (Internationalized Domain Names in Applications) encoding. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization, but to xn--11b2fg after NFC normalization. The non-standard A-label does not round-trip to the original host, creating host-parsing disagreements between security checks and HTTP clients. The vulnerability is classified under [CWE-1289] (Improper Validation of Unsafe Equivalence in Input).

Critical Impact
Callers using host() for allow/deny lists, SSRF filters, deduplication, or cache keys see a different host than the client actually fetches, enabling filter bypass.

Affected Products

Perl URI module versions before 5.36
Applications relying on URI::_idna for host normalization
Downstream libraries and tools consuming untrusted URLs via the URI module

Discovery Timeline

Vulnerability reported by Naseeb Dangi (@naseeb0) via GitHub Pull Request #191
2026-08-31 - CVE-2026-19953 published to NVD and disclosed on OpenWall OSS-Security
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-19953

Vulnerability Analysis

The defect lives in the nameprep step of URI::_idna. Nameprep lowercases each host label but omits the Unicode NFC (Normalization Form C) step mandated by RFC 5891 Section 5.2. Labels that are not already in NFC produce A-labels that differ from those generated by conformant IDNA implementations.

Because the emitted A-label does not round-trip back to the input, security logic that reads host() from a URI object built from attacker-controlled input observes a different host than a downstream HTTP client resolves. This mismatch enables allow-list and deny-list evasion, SSRF filter bypass, cache poisoning through inconsistent keys, and deduplication errors.

Root Cause

The nameprep routine implements case folding but never invokes Unicode normalization. IDNA requires input labels to be reduced to NFC before punycode encoding. Perl callers must add Unicode::Normalize and apply NFC() prior to encoding. The fixed version declares Unicode::Normalize as a dependency and normalizes labels inside nameprep.

Attack Vector

An attacker supplies a URL containing a host label built from precomposed or non-normalized Unicode code points. Server-side code parses the URL with URI, extracts the host with host(), and evaluates it against a security policy. The parsed host encodes to a non-standard A-label that does not match blocked hosts. A downstream HTTP client normalizes the host to NFC and connects to the real target, defeating the check.

text

# Patch: Changes file entry - URI 5.36
- Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host
  encoding matches other clients instead of emitting a non-standard,
  non-round-tripping A-label [CVE-2026-19953] (reported by Naseeb Dangi,
  @naseeb0) (GH#191)

# Patch: cpanfile - adds Unicode::Normalize dependency
+    requires "Unicode::Normalize" => "0";

Source: GitHub URI Patch Commit 956619a

Detection Methods for CVE-2026-19953

Indicators of Compromise

Outbound HTTP or DNS requests to hosts containing non-standard punycode A-labels such as xn--72b5c that do not appear in application allow lists.
Log entries where the parsed host() value differs from the host observed on the wire by upstream proxies or DNS resolvers.
URLs containing precomposed Unicode code points, such as Devanagari U+0958 U+093E, submitted to user-facing URL fields.

Detection Strategies

Inventory Perl services that use URI and compare installed versions against 5.36 using cpan -D URI or package manifests.
Audit application code paths that call URI->new(...)->host and feed the result into allow/deny lists, SSRF filters, cache keys, or deduplication logic.
Introduce parity tests that compare URI output against a conformant IDNA implementation for a corpus of non-NFC labels.

Monitoring Recommendations

Log all outbound URL fetches with both the pre-resolution host string and the post-resolution DNS target for correlation.
Alert on connections to internal RFC1918 destinations originating from URL-fetching services whose policy checks passed.
Track dependency drift on the URI CPAN module in CI pipelines and container base images.

How to Mitigate CVE-2026-19953

Immediate Actions Required

Upgrade the Perl URI module to version 5.36 or later on every host running affected Perl applications.
Install Unicode::Normalize as a runtime dependency alongside the patched URI release.
Re-review SSRF and URL allow-list logic for reliance on host() output, and add secondary validation after DNS resolution.

Patch Information

The fix is committed in GitHub commit 956619a and released in URI 5.36. See the MetaCPAN URI Change Log for the release entry. The patch applies Unicode NFC normalization inside URI::_idnanameprep and adds Unicode::Normalize to cpanfile.

Workarounds

Apply Unicode::Normalize::NFC() to host strings before passing them to URI in code paths that cannot be upgraded immediately.
Reject URLs containing non-ASCII host labels at ingress if internationalized domains are not required by the application.
Resolve the host to its canonical A-label with an IDNA-conformant library and validate that value against security policies rather than trusting URI->host.

bash

# Upgrade URI to the patched release
cpanm URI@5.36
cpanm Unicode::Normalize

# Verify installed version
perl -MURI -e 'print $URI::VERSION, "\n"'