CVE-2026-19953

Name of the Vulnerable Software and Affected Versions URI for Perl versions prior to 5.36

Description Missing normalization in nameprep causes non-NFC host names to be encoded into non-standard punycode labels. While nameprep lowercases host labels, it fails to perform Unicode normalization to Form C, which is required by IDNA (Internationalizing Domain Names in Unicode). Consequently, labels not already in NFC are encoded into A-labels that differ from their normalized forms and do not round-trip back to the original label. This discrepancy can lead to security failures when the host() function is used on untrusted input for security decisions, such as SSRF filters, allow/deny lists, cache keys, or deduplication, as the security check may see a different host than the one resolved by the fetching client.

Recommendations Update to version 5.36 or later.