rewindex

RewindexCVEs

CVE-2026-6321: fast-uri vulnerable to path traversal via percent-encoded dot segments

High · CVSS 7.5 (CVSS 3.1)EPSS 0.63%, 50th percentilePublished Updated Assigner: openjs

Description

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · CWE-22

Tracked companies

BitbucketConfluenceJira

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

fast-uri: fast-uriRed Hat: Cluster Observability Operator 1.5.0Red Hat: Confidential Compute AttestationRed Hat: Cryostat 4Red Hat: HawtIO HawtIO 4.4.0Red Hat: OpenShift PipelinesRed Hat: Red Hat Ansible Automation Platform 2Red Hat: Red Hat Ansible Automation Platform 2.5Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat: Red Hat Ansible Automation Platform 2.6Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat: Red Hat Build of Podman DesktopRed Hat: Red Hat Build of Podman Desktop - Tech PreviewRed Hat: Red Hat Data Grid 8Red Hat: Red Hat Developer HubRed Hat: Red Hat Enterprise Linux 10Red Hat: Red Hat Enterprise Linux 9Red Hat: Red Hat OpenShift AI (RHOAI)Red Hat: Red Hat OpenShift Container Platform 4Red Hat: Red Hat Satellite 6Red Hat: streams for Apache Kafka 2Red Hat: streams for Apache Kafka 3

References

All CVEsMarkdownJSON