CVE-2026-6322

Aliases:GHSA-v39h-62p7-jpjcDEBIAN-CVE-2026-6322CGA-9849-cc8h-m7cmCGA-9w8v-f9vm-hm2cCGA-c49j-q75q-v8fmCGA-ch5w-4p95-c5f5CGA-g3x6-234g-7jg8CGA-g8mm-682v-qfmmCGA-hgc2-963f-3phpCGA-jwcx-jqrr-qcpqCGA-pggf-7vjg-9ccmCGA-257q-4j97-5m2rCGA-266m-9xfc-7mxwCGA-2743-jg92-6wfcCGA-2pgq-4r2p-5h2gCGA-2r3g-vjf9-wg6rCGA-33w7-8228-vqvgCGA-3c66-4jwv-pv4gCGA-3fcj-hjx9-rqx2CGA-3ffw-gx8m-mfx6CGA-3ghg-88vx-x77mCGA-3gj2-chm4-6g6fCGA-3hf6-8pwf-949cCGA-3q82-vw32-qfwrCGA-3rmc-538r-8f6hCGA-43g3-v576-54cpCGA-47pf-qhm7-6h94CGA-48h9-qgj8-xp2jCGA-48pg-v542-55h5CGA-4g9q-9c4p-85wfCGA-4gx6-v8wr-hxvvCGA-4mmq-7jjq-cvmjCGA-4r6c-xcmq-67mvCGA-4rqw-xxmp-x2cmCGA-536g-7w49-qp85CGA-55f7-g4gw-f239CGA-57w4-vhrr-62pjCGA-596h-93pf-j6p5CGA-5c5w-897j-mc93CGA-5cmf-2cf3-jwc5CGA-5ffg-vg8r-3g9jCGA-5qmh-cc9c-6gwhCGA-5r6h-pffm-r372CGA-5vw5-9j43-rwg2CGA-5w58-q774-h3v4CGA-65m5-m9gq-c7mrCGA-669x-4v5v-4cr6CGA-6c6h-p248-3mwjCGA-6g8h-p7q8-q29vCGA-6hmp-hj9g-c4f8CGA-6j5h-f63f-7x4hCGA-6jph-qhhg-jjc8CGA-6m49-4f5p-jx7pCGA-6p5j-pj56-gf4hCGA-6rh2-7mx3-qxq2CGA-6wwm-x2rw-45hrCGA-6xrj-rw86-f7g5CGA-7224-q6x8-p85hCGA-757r-frr6-x5x7CGA-7cpg-263h-785fCGA-7f9f-r3m9-5x7mCGA-7g63-677c-w4j5CGA-7gf5-4vrw-4vhvCGA-7hf6-v2ph-94gwCGA-7m3v-hxpr-rchwCGA-7qw9-8p6m-984jCGA-7rq3-6g9c-q2vfCGA-863v-fj28-9gfmCGA-8783-23r5-ffr2CGA-89p4-wc8c-5mv4CGA-8gc8-f8qx-hv7cCGA-8gf7-9863-f26mCGA-8h49-p278-gm8vCGA-8vc7-28px-fp7gCGA-8w3j-3927-gqw9CGA-8wcp-x352-22v6CGA-8xrx-2mhm-fmqqCGA-98cc-7rmm-vqhjCGA-9fmm-9hgq-65frCGA-9hx6-9hvq-p894CGA-9jfx-hv25-h3hvCGA-9q44-p797-42hrCGA-c3j3-pqg6-6567CGA-c5cv-x835-jx39CGA-c5jw-pp8p-638gCGA-c6fr-vj9f-r9gvCGA-c8q9-jcq3-v6q6CGA-c98j-g6g2-9qxcCGA-c9g9-vrj3-fcwhCGA-cc34-4wmm-7hjfCGA-cm74-99pp-856vCGA-cmx2-gh4h-x9mvCGA-cp8r-67r7-4g64CGA-cq27-h8h3-v9gcCGA-cw6v-69cm-34hgCGA-cx2w-xg73-6fj9CGA-f3h9-pfc5-cg25CGA-f3wp-35h4-jwmrCGA-f48x-p3g8-fmx8CGA-f4pm-5r8q-c934CGA-f8gg-fp84-rm5rCGA-fg4v-3pjm-82j4CGA-fqf8-p7q5-788wCGA-fqj8-373x-fmq7CGA-fr6x-w942-97r3CGA-g24w-jhg8-vvcvCGA-g4fc-h4pc-xw76CGA-gfc4-4x8f-mrf9CGA-gfvc-gq4r-4828CGA-gjhp-5hmc-v95wCGA-gp9v-fpxv-8h52CGA-gr4g-m3fc-vr97CGA-h362-p89h-vxqfCGA-h7gv-wqg6-66qcCGA-hcrp-84gj-vgg9CGA-hggm-5x6m-55wvCGA-hhg3-v77h-hj3wCGA-hm5r-xmhf-xfm2CGA-hrj4-mf8j-wmj8CGA-hvrm-63q2-rhp6CGA-hwq3-jcjh-xrrvCGA-j32p-7xf8-ww46CGA-j7rp-gjqg-r2q4CGA-j8j7-gv4g-fjjmCGA-jf9f-625q-fm4wCGA-jgq7-6r9x-4gqgCGA-jj6h-2cq9-qh29CGA-jr4m-r3rj-fp4pCGA-jv4c-8483-qfhcCGA-jvpq-2p7v-h82fCGA-m2x4-2v2g-5mhjCGA-m3gj-64xg-hm4fCGA-m3vj-r3vp-vp88CGA-m8vj-p7w5-36v6CGA-m9xf-vv3v-cxxhCGA-mfw4-7v2j-5mwhCGA-mjjx-j85x-mv5hCGA-mm2h-2r6g-jx5mCGA-mm5g-cpq7-jjxwCGA-mmpf-ffmf-p4w7CGA-mqvm-prrv-j9rhCGA-mr7m-7827-2357CGA-mx23-wh3f-jxfgCGA-mxx3-gq69-mv2vCGA-p6v2-xj7h-mv7jCGA-p885-4qgq-f33cCGA-pj9q-x4rx-jwpwCGA-pqp4-9mvr-8563CGA-pxm5-r8xx-fh8xCGA-q3m8-wmjq-c4r5CGA-q5m5-fhh5-6m8mCGA-q94h-jvh2-3cvhCGA-q9qf-796h-g8wgCGA-qccp-x6x4-7q53CGA-qcqj-gw6p-m95xCGA-qh2x-hmfp-qcprCGA-qmgf-5q8c-g4xgCGA-qw2j-2q9v-c68rCGA-qxh8-2c6m-8r73CGA-r3g7-frcj-qj29CGA-r7hr-5rcq-jhfvCGA-rgvv-6f9x-p4v3CGA-rm66-4cf6-q5wgCGA-rmq8-q37j-ch52CGA-rr26-x7gf-3qh5CGA-rrxf-q6m2-3gvrCGA-rw28-h89c-2x9jCGA-rx2m-395g-4rgxCGA-rx94-v748-frrmCGA-v7r9-rw6m-8fv6CGA-v8hm-4vxw-5m7xCGA-vgqm-gc85-hjc8CGA-vhc5-h44p-hff7CGA-vm2w-p5fw-jpwvCGA-vmm5-q397-3g4xCGA-vpjh-3j8w-qqx9CGA-vx6q-2xmx-c3v9CGA-vxj3-8mc5-rpf6CGA-w272-g2cj-qpv2CGA-w2hg-9w2j-gxf6CGA-w64q-q7px-h95vCGA-wcjr-7w98-x6j8CGA-wj8j-pgwr-hg72CGA-wm82-ghh6-cw3mCGA-wmf6-fw6r-r4vxCGA-wmgj-h325-38p8CGA-ww96-rxj4-5x48CGA-wx7q-4hvh-cv88CGA-x223-9ppp-rmh2CGA-x27v-hr38-4mjxCGA-x44w-73qf-w5gmCGA-x4f8-wv3x-4jccCGA-x5gj-fch6-8vvqCGA-x844-6564-v67jCGA-x97j-r7mw-2q54CGA-xf4r-f66g-hxpqCGA-xg74-rmqx-g999CGA-xph3-rxjr-r6vjCGA-xrxg-rv2x-4jv4CGA-xx3v-6767-mqf7CGA-589v-crg2-grq7CGA-8rr4-crm2-x366CGA-fw9h-w5q6-g7rhCGA-8fhf-jwwr-c284CGA-8pgx-xrg7-87wxCGA-5865-xrrw-vvjfCGA-6952-j63m-v46cCGA-9vx3-jv2w-cxjgCGA-c35c-cq65-5vh8
Advisory lineage Upstream: 0 Downstream: 6
Modified
Published: 05 May 2026, 10:29
Last modified:10 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.51% LOW
1% probability +0.04%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 May 2026, 10:29
Published
Vulnerability first disclosed
10 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.51%• Percentile: 43%

Techniques & Countermeasures

  • CWE-436•Interpretation Conflict

    Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

  • CWE-140•Improper Neutralization of Delimiters

    The product does not neutralize or incorrectly neutralizes delimiters.

Affected Systems

  • chainguard•airflow-2

    all

  • chainguard•airflow-core-2

    all

  • chainguard•arangodb-3.12

    < 3.12.7.2-r5

  • chainguard•argo-workflows-ui-3.6

    < 3.6.19-r6

  • chainguard•commercial-gitlab-rails-ee-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-19.3

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.1

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.2

    all

  • chainguard•commercial-gitlab-rails-ee-fips-19.3

    all

  • chainguard•drupal-11.3

    < 11.3.13-r3

  • chainguard•gitlab-rails-ce-18.1

    < 18.1.6-r36

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.11

    all

  • chainguard•gitlab-rails-ce-18.5

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    < 19.0.3-r1 | all

  • chainguard•gitlab-rails-ce-19.1

    < 19.1.7-r4

  • chainguard•gitlab-rails-ce-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-19.3

    < 19.3.1-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    < 18.1.6-r15 | all

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.11

    all

  • chainguard•gitlab-rails-ce-fips-18.5

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    < 19.1.1-r1 | < 19.1.6-r5

  • chainguard•gitlab-rails-ce-fips-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-fips-19.3

    < 19.3.1-r3

  • chainguard•keep-ui

    < 0.51.0-r7

  • chainguard•keep-ui-fips

    < 0.51.0-r7

  • chainguard•kibana-8.17

    < 8.17.10-r21

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r21

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r21

  • chainguard•kibana-8.19

    < 8.19.15-r0

  • chainguard•kibana-8.19-bitnami

    < 8.19.15-r0

  • chainguard•kibana-8.19-iamguarded

    < 8.19.15-r0

  • chainguard•kibana-9.0

    < 9.0.8-r25

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r25

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r25

  • chainguard•kibana-9.1

    < 9.1.10-r17

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r17

  • chainguard•kibana-9.2

    < 9.2.8-r3

  • chainguard•kibana-9.2-iamguarded

    < 9.2.8-r3

Showing first 50 affected entries in server-rendered view.

References (52)