RLSA-2026:98472: Moderate: perl-URI security update
This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732).
Security Fix(es):
URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/perl-URIto a version that resolves this vulnerability.Fixed in 0:5.09-4.el9_9
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges, and no user interaction required. Successful exploitation depends on reaching functionality that processes attacker-controlled URI hostnames.
What is the likely impact of successful exploitation?
The issue is a security bypass caused by missing Unicode normalization during hostname encoding. The supplied CVSS vector indicates low confidentiality and integrity impact, no availability impact, and scope change.
How can I determine whether my system needs remediation?
Check whether rocky-linux/perl-uri is installed and compare its installed package state against the security update provided by RLSA-2026:98472. The advisory identifies CVE-2026-19953 as the addressed issue.