AZL-98562 CVE-2026-19953 affecting package perl-URI 5.21-2

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

CVE-2026-19953

CVE-2026-19953 affects Perl URI versions before 5.36 . The root cause lies in the nameprep function, which lowercases host labels but omits the NFC Unicode normalization required by IDNA (RFC 5891) before punycode encoding. As a result, non-NFC host labels encode to a non-standard A-label that do...