CVE-2026-6322
EUVD-2026-2724805.05.2026, 11:16
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openjsf | fast-uri | 𝑥 < 3.1.2 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260715-1.el8ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260715-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 0:2.6.10-1.el9ap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 0:1.1.1-1.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782840519 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839981 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839193 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782838753 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839279 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782840539 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782841925 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782838476 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839996 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839494 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.11.0 | 1780910888 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1780600823 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1782761510 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | 1782721130 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | 1783919486 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.10 | 1783448184 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1781187342 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1782166952 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502765 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502438 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194938 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194574 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784126822 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784127736 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit 1.8 | 1783690532 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | 1784109883 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1782880472 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1782313844 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1783602326 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1782308519 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1782914001 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1783502338 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 1782224390 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 1782224316 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 1782224099 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.1 | 1782487717 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1781937357 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1783955846 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1781878070 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1781032495 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
Vulnerability Media Exposure
References