fast-uri up to 3.1.1 normalize interpretation conflict

Summaryinfo

A vulnerability marked as problematic has been reported in fast-uri up to 3.1.1. This affects the function normalize. The manipulation leads to interpretation conflict. This vulnerability is uniquely identified as CVE-2026-6322. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in fast-uri up to 3.1.1. This issue affects the function normalize. The manipulation with an unknown input leads to a interpretation conflict vulnerability. Using CWE to declare the problem leads to CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. Impacted is integrity. The summary by CVE is:

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-6322 since 04/14/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 312304 (Linux Distros Unpatched Vulnerability : CVE-2026-6322), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.1.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (312304) and CERT Bund (WID-SEC-2026-2142). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Red Hat OpenShift

Productinfo

Name

• fast-uri

Version

• 3.1.0
• 3.1.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion