Fast-URI Path Normalization Bypass Fast-URI <=3.1.0
CVE-2026-6321 Published on May 4, 2026

fast-uri vulnerable to path traversal via percent-encoded dot segments
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

NVD

Vulnerability Analysis

CVE-2026-6321 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-6321 has been classified to as a Directory traversal vulnerability or weakness.

Products Associated with CVE-2026-6321

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Apache Camel Hawtio

Red Hat Network Observ Optr

Red Hat Ansible Automation Platform

Red Hat Rhdh

Red Hat Discovery

Red Hat Openshift Ai

Red Hat Openshift Devspaces

Red Hat Openshift Data Foundation

Red Hat Satellite

Red Hat Confidential Compute Attestation

Red Hat Openshift Pipelines

Red Hat Podman Desktop

Red Hat Jboss Data Grid

Red Hat Openshift

Red Hat Cryostat

Red Hat Enterprise Linux (RHEL)

Red Hat Amq Streams

Red Hat Cluster Observability Operator

Affected Versions

fast-uri:

Before 3.1.1 is affected.
Version 3.1.1 is unaffected.

Red Hat HawtIO HawtIO 4.4.0: Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:2.5.20260715-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:2.5.20260715-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:2.6.11-1.el9ap and below * is unaffected.

Red Hat Enterprise Linux 10:

Version 0:1.1.1-1.el10_2 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782840519 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782839981 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782839193 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782838753 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782839279 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782840539 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782841925 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782838476 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782839996 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.2:

Version 1782839494 and below * is unaffected.

Red Hat Network Observability (NETOBSERV) 1.12.1:

Version 1780556069 and below * is unaffected.

Red Hat Ansible Automation Platform 2.5:

Version 1780082949 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1779784904 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1779783248 and below * is unaffected.

Red Hat Developer Hub 1.8:

Version 1779841586 and below * is unaffected.

Red Hat Developer Hub 1.9:

Version 1781187342 and below * is unaffected.

Red Hat Discovery 2:

Version 1779395188 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1780467029 and below * is unaffected.

Red Hat OpenShift AI 2.25:

Version 1780467147 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781183284 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781183499 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663368 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781184121 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663596 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781183713 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663548 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781183811 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781184611 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663638 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663861 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663920 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781184484 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780663886 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781184239 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780664089 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1780664140 and below * is unaffected.

Red Hat Openshift Data Foundation 4.16:

Version 1781184468 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555717 and below * is unaffected.
Version 1786705347 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781554936 and below * is unaffected.
Version 1786706101 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555645 and below * is unaffected.
Version 1786705558 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556009 and below * is unaffected.
Version 1786705646 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781558423 and below * is unaffected.
Version 1786706138 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555708 and below * is unaffected.
Version 1786705741 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557202 and below * is unaffected.
Version 1786705777 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555679 and below * is unaffected.
Version 1786705802 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557189 and below * is unaffected.
Version 1786705938 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556534 and below * is unaffected.
Version 1786706577 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556085 and below * is unaffected.
Version 1786706125 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781555971 and below * is unaffected.
Version 1786706177 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557158 and below * is unaffected.
Version 1786706188 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556690 and below * is unaffected.
Version 1786706679 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781558326 and below * is unaffected.
Version 1786706357 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556544 and below * is unaffected.
Version 1786706612 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556958 and below * is unaffected.
Version 1786706644 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781556901 and below * is unaffected.
Version 1786706659 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1781557496 and below * is unaffected.
Version 1786706880 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778576707 and below * is unaffected.
Version 1786701839 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778576350 and below * is unaffected.
Version 1786701555 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778769574 and below * is unaffected.
Version 1786702052 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778576929 and below * is unaffected.
Version 1786702559 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778770148 and below * is unaffected.
Version 1786702713 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778576957 and below * is unaffected.
Version 1786702264 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1779093256 and below * is unaffected.
Version 1786702448 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577150 and below * is unaffected.
Version 1786702276 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577175 and below * is unaffected.
Version 1786702440 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577083 and below * is unaffected.
Version 1786702315 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778770362 and below * is unaffected.
Version 1786703071 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577169 and below * is unaffected.
Version 1786702563 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577201 and below * is unaffected.
Version 1786702636 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577489 and below * is unaffected.
Version 1786702623 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778770439 and below * is unaffected.
Version 1786703137 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577548 and below * is unaffected.
Version 1786702716 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778770127 and below * is unaffected.
Version 1786702872 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577523 and below * is unaffected.
Version 1786702949 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577519 and below * is unaffected.
Version 1786702917 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1778577696 and below * is unaffected.
Version 1786703143 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627460 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786626399 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628235 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627106 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629761 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627559 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786687918 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629478 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628142 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786631508 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628053 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627382 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627430 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629076 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627469 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786644072 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786688215 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628340 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628623 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786632256 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628935 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629548 and below * is unaffected.