VDB
RHSA-2026:54555
RHSA-2026:54555
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9@sha256:c487aba7199049a74d5689c7627801e525e0149df6932fab02bf2bf6f042fa76_s390x as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-lifecycle-manager-rhel9@sha256:8dd0e1d4659c2dc3b56774ad62ed410a01b563d9483e9e3fec77b427d54463c6_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-rhel9@sha256:40e69bb9a55ee91955ba3a2732d06349b97e3caf6ab2d5d4b8c7c719e6d49201_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:49ba5ee0e8eb80e60d528badc85ab4ee4f69ecfaa0bf82c335e83d3e24f2f7f3_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-rhel9@sha256:3fc9c16d584c58e2380fb299a6452756d14fc8b440e79cb9531706dc6df6455f_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:de4d7f1660840f58125549b6b6b49f8d30ff0d461c03590af9187dbb4947f3bf_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-must-gather-rhel9@sha256:ca6122f480efdc71c2602125b421d176cbbd6d68266d46f98b4e883fd18fe03d_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:f18beb0f64eec1a7b645172dc4239adc5dfcae946b1ea9e81bf2b353e5fa9348_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:0f47910a4574cae59a5d6ee902f040f7c75885b1f27766229dc018313d523440_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:3a848e1ed35f422499aaf0b9ca47cea57872f5184ad5f7abe951a05c0ad44424_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator@sha256:04c47833af4bc434069efbc0d43fef04adcdf86824b89243546c7f5bf643a100_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-cluster-api-controllers-rhel9@sha256:1970f4a9d18ab91111da2acdd0b5911f6d2507457f55cdb4f16022d53a462a9e_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-network-rhel9-operator@sha256:d5717c459bdd56ca27471cc3592ef43fb6c0708db511df3768c80fa07da51556_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel9@sha256:3834aec0c5b9ed8125e9a997f3166f1cc39f0bffb59dc24055368fdac5061f1f_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel9@sha256:2ae5668bdbf49a1db3b0c3c0d87c01589b46b6f85f19d8d3206287afe4ecd77c_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-storage-rhel9-operator@sha256:786698873b01301ed8d5f51170393d8f3f61ebf23f3671513abb6602d1843d5e_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-version-rhel9-operator@sha256:c388a5d3baef6dcce8cae70cf422c668911a91e75b07be1f3e4e08640afa0672_amd64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-framework-tools-rhel9@sha256:59494c759502685bb35caa079e675f8c1d09f055c0093668a11c13d23479730c_s390x as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:c1fb54c78b0ccb640aff8c2918a914f350f457d2d7055cd2e45f17730d697531_ppc64le as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator@sha256:deaee0823763fc28b878c92ef27fa65a4fa4f3a3b671435aaf8fac1fecd704bb_arm64 as a component of Red Hat OpenShift Container Platform 4.19 | *, * |
…and 636 more
Timeline
- Aug 19, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54555 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-44293 advisory
- https://access.redhat.com/security/cve/CVE-2026-44488 advisory
- https://access.redhat.com/security/cve/CVE-2026-44495 advisory
- https://access.redhat.com/security/cve/CVE-2026-50236 advisory
- https://access.redhat.com/security/cve/CVE-2026-50237 advisory
- https://access.redhat.com/security/cve/CVE-2026-6322 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54555.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466684 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6322 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6322 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467820 issue
- https://www.cve.org/CVERecord?id=CVE-2026-39820 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39820 advisory
- https://go.dev/cl/759940 advisory
…and 27 more