liburi-perl - Debian Package Tracker

general

source: liburi-perl (main)
version: 5.40-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: gregor herrmann (DMD) – Angel Abad (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.08-1
oldstable: 5.17-1
stable: 5.30-1
testing: 5.40-1
unstable: 5.40-1

versioned links

5.08-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.17-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.30-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.40-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

liburi-perl (2 bugs: 0, 0, 2, 0)

action needed

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-19953: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

Created: 2026-08-25 Last update: 2026-09-01 05:00

2 bugs with a patch to review in the bug tracker normal

The bug tracker contains patches fixing 2 bugs to review: include them, or remove the patch tag.

Created: 2026-09-02 Last update: 2026-11-09 23:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 5.40-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit b19dd77ad94f71715af716396fa33a5cadba934a
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 17:35:49 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 18d60f9f9d63e7db28f1734aeaa0fd5676351312
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 17:35:49 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-08 17:33

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-19953: (needs triaging) URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded (RFC 5891), so a label that is not already in NFC is encoded to a different A-label than its normalized form. A label built from the precomposed Devanagari sequence U+0958 U+093E encodes to xn--72b5c without normalization but to xn--11b2fg after NFC normalization, and xn--72b5c does not round-trip back to the original label. Any caller that reads host() from a URI built from untrusted input and uses it for a security decision (an allow or deny list, an SSRF filter, deduplication, a cache key) sees the non-standard label, while a client that fetches the same URL resolves the NFC form, so the check and the fetch can disagree about the host.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-08-25 Last update: 2026-11-01 22:00

news

[rss feed]

[2026-11-02] liburi-perl 5.40-1 MIGRATED to testing (Debian testing watch)
[2026-10-26] Accepted liburi-perl 5.40-1 (source) into unstable (gregor herrmann)
[2026-09-09] liburi-perl 5.37-1 MIGRATED to testing (Debian testing watch)
[2026-09-05] Accepted liburi-perl 5.37-1 (source) into unstable (Samuel Young)
[2026-09-01] liburi-perl 5.36-1 MIGRATED to testing (Debian testing watch)
[2026-08-25] Accepted liburi-perl 5.36-1 (source) into unstable (gregor herrmann)
[2026-06-19] liburi-perl 5.35-1 MIGRATED to testing (Debian testing watch)
[2026-06-15] Accepted liburi-perl 5.35-1 (source) into unstable (Samuel Young) (signed by: gregor herrmann)
[2025-11-02] liburi-perl 5.34-2 MIGRATED to testing (Debian testing watch)
[2025-10-11] Accepted liburi-perl 5.34-2 (source) into unstable (gregor herrmann)
[2025-09-28] Accepted liburi-perl 5.34-1 (source) into unstable (gregor herrmann)
[2024-10-12] liburi-perl 5.30-1 MIGRATED to testing (Debian testing watch)
[2024-10-09] Accepted liburi-perl 5.30-1 (source) into unstable (gregor herrmann)
[2024-09-11] liburi-perl 5.29-1 MIGRATED to testing (Debian testing watch)
[2024-09-07] Accepted liburi-perl 5.29-1 (source) into unstable (gregor herrmann)
[2024-04-07] liburi-perl 5.28-1 MIGRATED to testing (Debian testing watch)
[2024-03-31] Accepted liburi-perl 5.28-1 (source) into unstable (gregor herrmann)
[2024-02-19] liburi-perl 5.27-1 MIGRATED to testing (Debian testing watch)
[2024-02-14] Accepted liburi-perl 5.27-1 (source) into unstable (gregor herrmann)
[2024-02-14] liburi-perl 5.26-1 MIGRATED to testing (Debian testing watch)
[2024-02-09] Accepted liburi-perl 5.26-1 (source) into unstable (gregor herrmann)
[2024-02-06] liburi-perl 5.25-1 MIGRATED to testing (Debian testing watch)
[2024-01-28] Accepted liburi-perl 5.25-1 (source) into unstable (gregor herrmann)
[2023-09-05] liburi-perl 5.21-1 MIGRATED to testing (Debian testing watch)
[2023-09-02] Accepted liburi-perl 5.21-1 (source) into unstable (gregor herrmann)
[2023-06-22] liburi-perl 5.19-2 MIGRATED to testing (Debian testing watch)
[2023-06-18] Accepted liburi-perl 5.19-2 (source) into unstable (gregor herrmann)
[2023-06-11] Accepted liburi-perl 5.19-1 (source) into unstable (gregor herrmann)
[2022-11-24] liburi-perl 5.17-1 MIGRATED to testing (Debian testing watch)
[2022-11-21] Accepted liburi-perl 5.17-1 (source) into unstable (gregor herrmann)

bugs [bug history graph]

all: 2
RC: 0
I&N: 0
M&W: 2
F&P: 0
patch: 2

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.35-1