CVE-2026-6321

EUVD-2026-27129

04.05.2026, 20:16

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Path Traversal

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 41.37%

Affected Products (NVD)

Vendor	Product	Version
openjsf	fast-uri	𝑥 < 3.1.1

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	0:2.5.20260715-1.el8ap ≤ 𝑥 < *	ADP
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	0:2.5.20260715-1.el9ap ≤ 𝑥 < *	ADP
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	0:2.6.11-1.el9ap ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 10	0:1.1.1-1.el10_2 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782840519 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782839981 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782839193 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782838753 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782839279 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782840539 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782841925 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782838476 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782839996 ≤ 𝑥 < *	ADP
Red Hat	Cluster Observability Operator 1.5.0	1782839494 ≤ 𝑥 < *	ADP
Red Hat	Network Observability \(NETOBSERV\) 1.12.0	1780556069 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Ansible Automation Platform 2.5	1780082949 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Ansible Automation Platform 2.6	1779784904 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Ansible Automation Platform 2.6	1779783248 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.8	1779841586 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Developer Hub 1.9	1781187342 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Discovery 2	1779395188 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1780467029 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 2.25	1780467147 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781183284 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781183499 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663368 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781184121 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663596 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781183713 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663548 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781183811 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781184611 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663638 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663861 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663920 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781184484 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780663886 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781184239 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780664089 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1780664140 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.16	1781184468 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781555717 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781554936 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781555645 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556009 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781558423 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781555708 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781557202 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781555679 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781557189 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556534 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556085 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781555971 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781557158 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556690 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781558326 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556544 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556958 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781556901 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.18	1781557496 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778576707 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778576350 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778769574 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778576929 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778770148 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778576957 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1779093256 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577150 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577175 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577083 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778770362 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577169 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577201 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577489 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778770439 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577548 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778770127 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577523 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577519 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Openshift Data Foundation 4.19	1778577696 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift Dev Spaces 3.28	1780685176 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Satellite 6.18	1781181673 ≤ 𝑥 < *	ADP