Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

perl-URI may crash when processing crafted URLs

published 16 days ago

Summary

Red Hat's perl-URI package, which reads web addresses, can be triggered by a specially crafted URL to make the program stop working. This could disrupt any service that relies on Perl scripts handling internet addresses. Install the latest Red Hat update for perl-URI promptly.

What to do

Update redhat perl-uri to version 0:1.73-4.el8_10.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::baseos	redhat	perl-uri	< 0:1.73-4.el8_10 Fix: upgrade to 0:1.73-4.el8_10

Original advisory text

Red Hat Security Advisory: perl-URI security update

References

https://access.redhat.com/errata/RHSA-2026:84590 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2526492 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84590.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-19953 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-19953 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-19953 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/31/14 Third Party Advisory
https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73... Third Party Advisory
https://github.com/libwww-perl/URI/pull/191 Third Party Advisory
https://metacpan.org/release/OALDERS/URI-5.36/changes Third Party Advisory
https://www.rfc-editor.org/rfc/rfc5891#section-5.2 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.2 High

Timeline

Published19 Oct 2026

Updated19 Oct 2026

First seen19 Oct 2026

Sources

RHSA-2026:84590 · OSV

Track software like this

Free during beta