VDB
RHSA-2026:54395
RHSA-2026:54395
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:17f37ac6f59685f0d332c970ee33d025cbe834f0f2ed684feee1d6084b7ef5fd_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:2c80074a85868ebbc3070868904dd35fd0c6e383f790915078f34c0a877987b5_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:730f609c5e53134320ca35b1dac4a87a2d042df313353df1640752576088769b_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:b6ba88e17383136cab3653b5bd2f7aeaea55f3a67d49e15f3610cdcbda751984_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:857003bf4a8d7de0fa1ac6e1b93b8264161daacb2f7101f6edcc99d8c0eb730c_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel9@sha256:ca340ee931147544b3f3023107234401c1e699b3b6417fd4464506b32896c12e_arm64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-bundle@sha256:e669e36a1e791d1b2751552b4c1cbffee0d95d3e2ccf2cffbd7c653b219795cc_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:bc1a330c680516b4ab6831ce434f5d4158897fa3d632a287872f0fb47e4e5372_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:d3601d847460c5023736da87f9d1aec44ff7a5b311f731a1818573a5ab82e966_ppc64le as a component of Red Hat Quay 3.17 | *, * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:345fce838fb057d96437df0c30bbbb90d4dec0d19fcd4ced8b11997adcbb0a89_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-bridge-operator-rhel9@sha256:c9871813ad1fa8410cd1954e7c16a6e939edca036be40df4b2117d1595bb6236_s390x as a component of Red Hat Quay 3.17 | *, * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:74edfcc5c7906b3cf16ab02b04eadc8633c7ae1870209a05aa7c6d8836dc3f15_s390x as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:bb4045f0222d4313f6a66b68bc69eb7ec000a4f820c2ca39bb84fde5d0ef45f9_ppc64le as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-rhel9@sha256:2f193ba7ede425c34d95c31a3c0c28e7ca6e1d9b07a09f8d4af5218dadae369d_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-operator-rhel9@sha256:32b9fd5174dbb720b470897f9caa708bac8a50a092f517e460f15e2ad8752882_amd64 as a component of Red Hat Quay 3.17 | *, * |
| Red Hat | registry.redhat.io/quay/clair-rhel9@sha256:c3c71d300d5d2ae451be96180405aec9a5afd1ef2b48099a1eb53a46b2548618_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:da241413377b6786f210017bdb38e83aa6d7323aae3e896cc9db1f06cc6eb62f_amd64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:19af2dbe8723373c8c231113aeab3fe46011c309cac2c6a938956274155e0923_arm64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-builder-rhel9@sha256:2b491bdad3973b56ec2c8198003788f8d46d1b2e882885155922bd750814b7e9_arm64 as a component of Red Hat Quay 3.17 | * |
| Red Hat | registry.redhat.io/quay/quay-container-security-operator-rhel9@sha256:f99cdde780614d394510e9e8f9a74321defe5615ce2201c1d6c1ff60567927ac_ppc64le as a component of Red Hat Quay 3.17 | * |
…and 12 more
Timeline
- Aug 12, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54395 advisory
- https://access.redhat.com/security/cve/CVE-2026-15927 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-6322 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54395.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466684 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6322 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6322 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2501256 issue
- https://www.cve.org/CVERecord?id=CVE-2026-15927 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-15927 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480756 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39821 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39821 advisory
- https://go.dev/cl/767220 advisory
- https://go.dev/issue/78760 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
…and 1 more