RHSA-2026:59593 | Vulnetix

RHSA-2026:59593 PUBLISHED CVSS 7.699999809265137 HIGH

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.

Risk Scores

CVSS 3.1

7.699999809265137

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:858938cc1df5013950e7bf6c5e54bc3ca644acfbf54823adce61b9f70ef41d6a_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/hive-rhel9@sha256:ec4df75908bc2a3dc45addfa02e07078f8039a6cc2a721f3ec17beaa52395b2e_ppc64le as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:2b73bce7c4009be5ff28cf34894829012f5d0af5c5f1110f476f587bf4cfbc88_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:fe3a586cbd202c2b6987668fc86aef645da77b367157613278d4bba173a19baf_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:366a2d221c4e083ffd81b1b24572d864d9a1b360e6294caf8f6f0623dde99f53_amd64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/maestro-rhel9@sha256:6b75ef955ab30efda9b34ccb41c8fc8f97c2330e8f79c4ebab121df0012c6f24_ppc64le as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:8d3256f9df83b82e8bdef2a8d0c706695d5c9674e263755cb1db42158140c5a5_amd64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:eb2d1d70ec1ad7ed41a0109f648c8e08d06fc72be2eabcd56b80a93d3c931c65_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:a48cc4475cdb9b0127af3754a98f403e9ee78bbaedaef09a3ade340177222828_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:e76b3688fc8f6646edf5968dbae1bf033e00017d424d6eae80fb06a5799bc65f_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/work-rhel9@sha256:62e856af9dc03f4a326c2ce598c3a88e243e189d5d64c91de64bae5a15ae799d_ppc64le as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:08ed033a12cd4e19a9509ae5a1235555ae1182f0c0dc85c4f813e28ee60da169_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:e51a459fa5a300f434cce93e5023b3528bc877d523a5a81b38b14847f50b1818_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:28d20ad256324b95702089797fed9df150ffc8c605438e352d1b0a8823ff8ac4_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:075ecc5594a6f75ce91e30d78d4c750822c8f759cbbe112e124b95af5ea7a40f_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:2ad5f3439fbb259d2a7fb53088f545da9a465ae432a31fa41c831ee8e658a193_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:c5c9900b49269b857773d1f421cfba7b3694fb21e650885408fb7740657f2242_ppc64le as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:61477d49a8aa3616c208680cbec73cc1e93c1dbae806c137e51269a376df9074_arm64 as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:c06fc33a7fa9f4d9c2ea8a1e3b71456ac4c304539c5c830682a54105943c0c4d_s390x as a component of multicluster engine for Kubernetes 2.17	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:7850c65cfb8bce2f8f8ad1f9169d023edf3e4cd7b994965ba2172434c7e1365e_amd64 as a component of multicluster engine for Kubernetes 2.17	*

…and 120 more

Timeline

Aug 25, 2026 CVE Published
Sep 2, 2026 CVE Updated
Sep 2, 2026 Distribution Patch
Sep 2, 2026 Distribution Patch
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:59593 advisory
https://access.redhat.com/security/cve/CVE-2026-13676 advisory
https://access.redhat.com/security/cve/CVE-2026-19130 advisory
https://access.redhat.com/security/cve/CVE-2026-27145 advisory
https://access.redhat.com/security/cve/CVE-2026-39829 advisory
https://access.redhat.com/security/cve/CVE-2026-39835 advisory
https://access.redhat.com/security/cve/CVE-2026-44740 advisory
https://access.redhat.com/security/cve/CVE-2026-44990 advisory
https://access.redhat.com/security/cve/CVE-2026-45623 advisory
https://access.redhat.com/security/cve/CVE-2026-47219 advisory
https://access.redhat.com/security/cve/CVE-2026-54272 advisory
https://access.redhat.com/security/cve/CVE-2026-59869 advisory
https://access.redhat.com/security/cve/CVE-2026-66794 advisory
https://access.redhat.com/security/cve/CVE-2026-66795 advisory
https://access.redhat.com/security/cve/CVE-2026-66804 advisory
https://access.redhat.com/security/cve/CVE-2026-66805 advisory
https://access.redhat.com/security/cve/CVE-2026-66808 advisory
https://access.redhat.com/security/cve/CVE-2026-67213 advisory
https://access.redhat.com/security/cve/CVE-2026-67214 advisory
https://access.redhat.com/security/cve/CVE-2026-69153 advisory

…and 130 more

Open in Interactive Console →