The URI module for Perl implements nameprep by lowercasing host labels but does not perform Unicode normalization. Because IDNA requires labels to be normalized to Form C before punycode encoding, an unnormalized label is encoded to a different A‑label than its NFC form, breaking round‑trip resolution. This mismatch means that a server reading the host component from a parsed URI may see a non‑standard label, while a user’s browser or DNS resolver will resolve the canonical NFC form, allowing an attacker to craft a URL that passes host‑based security checks (such as allow lists or SSRF filters) while the final connection uses a different hostname. The consequence is potential bypass of access controls, incorrect caching, and unpredictable network behavior.

The affected component is the URI Perl module provided by libwww-perl. All versions earlier than 5.36 are impacted. This includes releases distributed via CPAN and embedded in Perl applications that rely on this library for URI parsing.

The CVSS score is not disclosed, and the EPSS value is unavailable, but the vulnerability can be exploited by supplying crafted non‑NFC hostnames in any URI that is parsed by the vulnerable library. Because the mis‑encoding occurs prior to network communication, an attacker can manipulate host‑based decisions such as allow lists, redirection policies, or cache lookups. No active exploit is reported in KEV, but the potential impact on confidentiality, integrity, or availability warrants attention.