CVE-2026-19953: CWE-1289 Improper Validation of Unsafe Equivalence in Input

This vulnerability arises because the nameprep process in URI versions prior to 5.36 lowercases host labels but does not perform Unicode normalization to NFC form as required by IDNA (RFC 5891). Consequently, host labels that are not already normalized encode to different A-labels than their NFC-normalized counterparts. For example, a Devanagari sequence encodes differently without normalization, causing the encoded label used in security decisions to differ from the label resolved by clients. This mismatch can lead to security checks being bypassed or inconsistent behavior between security filters and actual DNS resolution.

The impact is limited to scenarios where software uses the host() value from a URI constructed from untrusted input for security decisions such as allow or deny lists, SSRF filtering, deduplication, or cache key generation. Because the encoded host label differs from the normalized label resolved by clients, attackers could bypass these security controls, potentially allowing unauthorized access or evasion of filtering mechanisms. There is no indication of direct code execution or denial of service. The CVSS score of 6.5 reflects a medium severity with low complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying solely on the host() value from URIs constructed from untrusted input for security decisions. Implement additional normalization to NFC form before encoding or use alternative validated libraries that comply with IDNA requirements. Monitor vendor communications for official patches or updates.