URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing
    normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA
    requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not
    already in NFC is encoded to a different A-label than its normalized form. A label built from the
    precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg
    after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that
    reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny
    list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches
    the same URL resolves the NFC form, so the check and the fetch can disagree about the host.
    (CVE-2026-19953)

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4070-1 advisory.

    This update for perl-URI fixes the following issue:

    - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization     in `nameprep`       (bsc#1277886).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4046-1 advisory.

    This update for perl-URI fixes the following issue:

    - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization     in `nameprep`       (bsc#1277886).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21773-1 advisory.

    This update for perl-URI fixes the following issue:

    - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization     in `nameprep`       (bsc#1277886).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing     normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA     requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not     already in NFC is encoded to a different A-label than its normalized form. A label built from the     precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg     after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that     reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny     list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches     the same URL resolves the NFC form, so the check and the fetch can disagree about the host.
    (CVE-2026-19953)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-09941e744b advisory.

    5.36 -  Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host encoding matches other clients     instead of emitting a non-standard, non-round-tripping A-label [CVE-2026-19953]



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32b0d26c4c advisory.

    5.36 -  Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host encoding matches other clients     instead of emitting a non-standard, non-round-tripping A-label [CVE-2026-19953]



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
459921	Echo: liburi-perl: security update to 5.30-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459921	Echo: liburi-perl: security update to 5.30-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
348482	SUSE SLES12 Security Update : perl-URI (SUSE-SU-2026:4070-1)	Nessus	SuSE Local Security Checks	Local	medium
348460	SUSE SLED15 / SLES15 Security Update : perl-URI (SUSE-SU-2026:4046-1)	Nessus	SuSE Local Security Checks	Local	medium
343955	openSUSE 16 Security Update : perl-URI (openSUSE-SU-2026:21773-1)	Nessus	SuSE Local Security Checks	Local	medium
339506	Linux Distros Unpatched Vulnerability : CVE-2026-19953	Nessus	Misc.	Local	medium
339199	Fedora 43 : perl-URI (2026-09941e744b)	Nessus	Fedora Local Security Checks	Local	medium
338857	Fedora 44 : perl-URI (2026-32b0d26c4c)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-19953

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium