Fedora 43 and 44 Vulnerability in perl-URI IDNA Normalization

Linuxsecurity

Fedora 43 and 44 Vulnerability in perl-URI IDNA Normalization

First seen 25 Aug 2026, 10:17 UTC • •30.9

Article Content

1 / 3

Browse articles

ThreatCluster •August 26, 2026 at 09:54 UTC

•CVE-2026-19953 affects Fedora 43 and 44 due to IDNA normalization issues.
•The vulnerability was patched on August 21, 2026, with perl-URI version 5.36-1.
•Users must upgrade using 'dnf' to mitigate potential security risks.

Fedora 43 and 44 face a significant vulnerability related to IDNA normalization in the perl-URI module, identified as CVE-2026-19953. This issue affects the handling of Unicode NFC normalization, leading to potential discrepancies in IDNA host encoding. The vulnerability was patched on August 21, 2026, by Jitka Plesnikova, with the release of perl-URI version 5.36-1. Users are advised to upgrade their systems using the 'dnf' update program to mitigate the risk. The flaw could allow for non-standard A-label emissions, which may impact interoperability with other clients. The updates are available for installation, and users should apply them promptly to ensure system security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 47d ago How this analysis works

Timeline

2026-08-21

Patch released for CVE-2026-19953

Fedora released perl-URI version 5.36-1 to address IDNA normalization issues affecting host encoding.

2026-08-23

Fedora 44 perl-URI update announced

An update for perl-URI in Fedora 44 was published, addressing the same IDNA normalization vulnerability.

2026-08-25

Current status of the vulnerability

As of today, users are urged to apply the updates to mitigate the risk associated with CVE-2026-19953.

More articles in this cluster (2)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Organization (1)

Fedora

Vulnerability (1)

CVE-2026-19953

Affected Platform (1)

Linux

Relationships

CVE-2026-19953 targets Linux
CVE-2026-19953 related to Fedora

Following this threat?

Track Fedora and CVE-2026-19953 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…