VDB
RHSA-2026:56968
RHSA-2026:56968
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:541ee36b88ee213d25ea7c516010f5338650b9859ae82a3e83773ad54f1802ad_s390x as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:0b574ac52b3a46e7ee06cff731341afdc5ba3d60486bbab555dc4a043295556c_s390x as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/devicefinder-rhel9@sha256:adc08a51dc66724d02e64b9f40e3c53210de3c4d236fd54499a955a661c6ddd5_ppc64le as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-blackbox-exporter-rhel9@sha256:7735c0e37a0f3319647a8270403d3ec2f104a443d086d7fd80c27b74dc8f65dc_arm64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:8636bf398aef1b361ca168775a4bcb7afec00be242e62e3d9389c64cc69cbc61_arm64 as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/ocs-operator-bundle@sha256:fbd2c8966ddff597576a828ef94420d8ab8230eb3297fd24c4e1149aa62813fb_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:76cd00d6333754fad4fa125f908f4deb11c88727bb37c13c2aaa1648c7f68ff8_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-rhel9-operator@sha256:0d9781ce6e34eee9f28da7a44515614293a9a845710e0d5333807a7f8e37f95f_ppc64le as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:d121c397df9505e07bc514ad5dc4bde8271b3f95cee32319d17094d1d93bc961_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:1f3a38eda3ff55a02a89558c53f2cdf6f99a08658f493da03edb3139570b1550_arm64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:2c8f581539f20e5fcb2cabc6b342719708d48ded5c5746b72f40add489e9184c_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:ab69604453a22597f3845b5652d3daf8155d39b51351e0adfc0da7b75798de1c_s390x as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/odf-operator-bundle@sha256:efee792df34488385193b653d9fe24cd232312653df65162d1c4665ad154399b_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:cd7f891e8e7413f11289ffe6d42274e73c72bb156008b3f55bec894a0f764f13_arm64 as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:9cfa3ff7a43b6da3aa7b028e0dc3261ddc2646cfd1b7a7294424b2f645cc9dbe_ppc64le as a component of Red Hat Openshift Data Foundation 4.21 | * |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:ddcf39e8ce0f92557d43d4da7b187778d84bda2869cb442e7d71f8d4f72e400d_s390x as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cli-rhel9@sha256:7fc84018c1add5ef74283909b65249ef289dd3378783c373782b14fd1f604fae_s390x as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:467e87b08a7abd0ad630707643b22633fd4e7683873a4dfe5a3df05345d22372_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:5558c708d374ef4257ef0420178e3a8226a008f407cc5244aa1961946410c68b_amd64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9@sha256:9ea718a3a96c44bcce3e66d59db0d24369080f5a4dd296b320c5a5dac577f694_arm64 as a component of Red Hat Openshift Data Foundation 4.21 | *, *, * |
…and 91 more
Timeline
- Aug 19, 2026 CVE Published
- Sep 24, 2026 CVE Updated
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:56968 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-6322 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56968.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466684 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6322 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6322 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455470 issue
- https://www.cve.org/CVERecord?id=CVE-2026-34986 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34986 advisory
- https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 advisory
- https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants advisory