VDB
RHSA-2026:50758
RHSA-2026:50758
PUBLISHED
CVSS 8.5 HIGH
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
Risk Scores
CVSS 3.1
8.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator@sha256:30b7fc93bbbddcc0ebfccaa542c69f2dff949ea822a6b5333aedbbcd0f4bd319_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9@sha256:31e5a78ce0422de975e9f07e748020b3b4a61334a2513f0340fc78bb8ba3ae6e_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-policy-controller-rhel9@sha256:271f5416c8eaa0f97b7436fde7e6eb1bca1ac0f3a171ab89be585710efc7cbb3_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/network-tools-rhel9@sha256:8bedc2716ca0f497ec58e74e56d957f8ea83a8332f9db954e28a4400db45a07c_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:348ac995ea069ce391f87bddb521bee532810da2603ccca3b2c3be22693a6358_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9-operator@sha256:7d1b70ba0db03f5b6fcba396ebdd6d86b6cfe12189b6b550921ecfd36329d27f_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-framework-tools-rhel9@sha256:75c41537869c2bae1ee83ba569cbf89b6e1dafc7763ef4e5548d1c493bbd8419_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:6b9aea79fd380b9f28b06a67061f111e2a440ccabe4e5c2ebba934d8499039fb_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-operator-rhel9@sha256:4cd7ed0b4442a8a8921e39e51c0b06862f3775abd2588491e23dc9b5392fa966_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel9@sha256:9670cd4add985397807564567ee27107d93a1c050bb67168f48452cef7326154_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:4056d3fd8cb53a8fff01c02cbc9c58d8ee5dac3e7b1b229815c0aed6b93b4e35_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:0e909082e81587a6c661a416e0572a7fe7f9be414403acbc0f6a21c5e71440a2_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9@sha256:0c676f00b1551e31d34ef993cf19036f1673fe839c0c0da1a2d9328493e4970c_amd64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-config-rhel9-operator@sha256:08dd993a2eb8c387cefd82ad58f75ef7e4fbcb0e6e4ed3ed7cd9c7169a4c1e8f_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-ibmcloud-cluster-api-controllers-rhel9@sha256:b0c41793d055f4b51dfec073fe106cc8dc13b70693fd64bdb6dcd49ef9ab3310_s390x as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:f7713dedc952e3c3bb1bfdf105a4cf50271e7538bd8b1c8080169eb22a9327a0_arm64 as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:22db47c0c0f1828b9214c9f90731eb5d6795ee7c3391c5e046854639c9b26823_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-apiserver-rhel9-operator@sha256:cec30264dcb228579970d31a3e9f33fe291c9065e06d9cc6b5c8b02d4256be06_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover-rhel9@sha256:85aa3e39cdb8f94d9708e3a72bdb13953e5e40fc336953c2a601e8599c133a8b_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-node-driver-registrar-rhel9@sha256:12fc48e0939a8e4842f0dfdc88d9a43d71331d87a7315a25c08a3af2cfbe1400_ppc64le as a component of Red Hat OpenShift Container Platform 4.16 | * |
…and 636 more
Timeline
- Aug 12, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50758 advisory
- https://access.redhat.com/security/cve/CVE-2026-13676 advisory
- https://access.redhat.com/security/cve/CVE-2026-16242 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-49332 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50758.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2494197 issue
- https://www.cve.org/CVERecord?id=CVE-2026-13676 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-13676 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2502690 issue
- https://www.cve.org/CVERecord?id=CVE-2026-16242 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16242 advisory
- https://github.com/openshift/hypershift/pull/9031 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449833 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 advisory
…and 12 more