Amazon Linux 2027 Preview Security Advisory: ALAS2027-2026-324
Advisory Released Date: 2026-11-09
Advisory Updated Date: 2026-11-10
Severity:
Medium
Issue Overview:
Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-19953:
URI::_idna::nameprep only lowercased the label and skipped the Unicode
normalization that RFC 3490/3491 require. As a result, a host that was
not already in NFC encoded to a non-standard A-label that disagrees with
what browsers, curl, Go, Java, and Python compute for the same input --
and that A-label does not round-trip. Code that reads $uri->host for a
security decision (allow/deny lists, SSRF filters, routing, dedup) could
therefore disagree with the host that is actually fetched.
Affected Packages:
perl-URI
Issue Correction:
Run dnf update perl-URI --releasever 2027.0.20261109 or dnf update --advisory ALAS2027-2026-324 --releasever 2027.0.20261109 to update your system.
New Packages:
noarch:
perl-URI-5.37-1.amzn2027.0.1.noarch
perl-URI-tests-5.37-1.amzn2027.0.1.noarch
src:
perl-URI-5.37-1.amzn2027.0.1.src