fast-uri <=3.1.1 URI Normalization Bypass via Percent-Decoded @
CVE-2026-6322 Published on May 5, 2026

fast-uri vulnerable to host confusion via percent-encoded authority delimiters
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

NVD

Vulnerability Analysis

CVE-2026-6322 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Types

Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Improper Neutralization of Delimiters

The software does not neutralize or incorrectly neutralizes delimiters.

Products Associated with CVE-2026-6322

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Acm

Red Hat Rhdh

Red Hat Discovery

Red Hat Quay

Red Hat Satellite

Red Hat Multicluster Engine

Red Hat Confidential Compute Attestation

Red Hat Migration Toolkit Applications

Red Hat Rhmt

Red Hat Network Observ Optr

Red Hat Openshift Lightspeed

Red Hat Openshift Pipelines

Red Hat Serverless

Red Hat Ansible Automation Platform

Red Hat Podman Desktop

Red Hat Jboss Data Grid

Red Hat Edge Manager

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Ai

Red Hat Openshift Ai

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Openshift Devspaces

Red Hat Container Native Virtualization

Red Hat Ansible Portal

Red Hat Cryostat

Red Hat Amq Broker

Red Hat Apache Camel Hawtio

Red Hat Ansible Automation Platform Developer

Red Hat Cluster Observability Operator

Affected Versions

fast-uri:

Before 3.1.2 is affected.
Version 3.1.2 is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 8:

Version 0:2.5.20260715-1.el8ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.5 for RHEL 9:

Version 0:2.5.20260715-1.el9ap and below * is unaffected.

Red Hat Ansible Automation Platform 2.6 for RHEL 9:

Version 0:2.6.10-1.el9ap and below * is unaffected.

Red Hat Data Grid 8.6.2: Red Hat Enterprise Linux 10:

Version 0:1.1.1-1.el10_2 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782840519 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782839981 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782839193 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782838753 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782839279 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782840539 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782841925 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782838476 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782839996 and below * is unaffected.

Red Hat Cluster Observability Operator 1.5.0:

Version 1782839494 and below * is unaffected.

Red Hat multicluster engine for Kubernetes 2.11:

Version 1780910888 and below * is unaffected.

Red Hat Advanced Cluster Management for Kubernetes 2.16:

Version 1780600823 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1782761510 and below * is unaffected.

Red Hat Ansible Automation Platform 2.6:

Version 1782721130 and below * is unaffected.

Red Hat Ansible Automation Platform 2.7:

Version 1783919486 and below * is unaffected.

Red Hat Developer Hub 1.10:

Version 1783448184 and below * is unaffected.

Red Hat Developer Hub 1.9:

Version 1781187342 and below * is unaffected.

Red Hat Discovery 2:

Version 1782166952 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502765 and below * is unaffected.

Red Hat Edge Manager 1.0:

Version 1783502438 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194938 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784194574 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784126822 and below * is unaffected.

Red Hat Edge Manager 1.1:

Version 1784127736 and below * is unaffected.

Red Hat Migration Toolkit 1.8:

Version 1783690532 and below * is unaffected.

Red Hat Migration Toolkit for Applications 8.2:

Version 1784109883 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1782880472 and below * is unaffected.

Red Hat OpenShift Container Platform 4.19:

Version 1786486822 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1782313844 and below * is unaffected.

Red Hat OpenShift Container Platform 4.20:

Version 1783602326 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1782308519 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1782914001 and below * is unaffected.

Red Hat OpenShift Container Platform 4.21:

Version 1783502338 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1782224390 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1782224316 and below * is unaffected.

Red Hat OpenShift Container Platform 4.22:

Version 1782224099 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705347 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706101 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705558 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705646 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706138 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705741 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705777 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705802 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786705938 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706577 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706125 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706177 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706188 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706679 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706357 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706612 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706644 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706659 and below * is unaffected.

Red Hat Openshift Data Foundation 4.18:

Version 1786706880 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786701839 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786701555 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702052 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702559 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702713 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702264 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702448 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702276 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702440 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702315 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703071 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702563 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702636 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702623 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703137 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702716 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702872 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702949 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786702917 and below * is unaffected.

Red Hat Openshift Data Foundation 4.19:

Version 1786703143 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627460 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786626399 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628235 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627106 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629761 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627559 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786687918 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629478 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628142 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786631508 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628053 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627382 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627430 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629076 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786627469 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786644072 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786688215 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628340 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628623 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786632256 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786628935 and below * is unaffected.

Red Hat Openshift Data Foundation 4.2:

Version 1786629548 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786627281 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786627168 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628067 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628657 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786627792 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786698066 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786627823 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628998 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786697443 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628916 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786630412 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786629773 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786630739 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628303 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786629324 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786628605 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786631438 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786697305 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786644678 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786634168 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786633448 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786634233 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786633986 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786633677 and below * is unaffected.

Red Hat Openshift Data Foundation 4.21:

Version 1786644362 and below * is unaffected.