Back Linuxsecurity

Fedora 44 perl-URI Update CVE-2026

Linuxsecurity •LinuxSecurity Advisories • August 23, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

This module implements the URI class. Objects of this class represent

"Uniform Resource Identifier references" as specified in RFC 2396 (and

updated by RFC 2732).

5.36 - Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round- tripping A-label [CVE-2026-19953]

* Fri Aug 21 2026 Jitka Plesnikova - 5.36-1 - 5.36 bump (rhbz#2520744) - Fix CVE-2026-19953 (IDNA host encoding / Unicode NFC normalization)

[ 1 ] Bug #2520744 - perl-URI-5.36 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-32b0d26c4c' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 44 Vulnerability in perl-URI IDNA Normalization Fedora 43 and 44 face a significant vulnerability related to IDNA normalization in the perl-URI module, identified as CVE-2026-19953. This issue affects the handling of Unicode NFC normalization, leading to potential discrepancies in IDNA host encoding. The vulnerability was patched on August 21, 2026, by Jitka Plesnikova, with the release of perl-URI version 5.36-1. Users are advised to upgrade their systems using the 'dnf' update program to mitigate the risk. The flaw could allow for non-standard A-label emissions, which may impact interoperability with other clients. The updates are available for installation, and users should apply them promptly to ensure system security. 2 sources 31

Extracted Entities

CVEs (1)

CVE-2026-19953