CVE-2026-118664
Description
A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service (DoS) by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks the application event loop. This prevents the application from handling incoming traffic, rendering the service unresponsive to all users.
Statement
Red Hat has evaluated this vulnerability as having an Important security impact because an unauthenticated remote attacker can monopolize server resources and cause a complete denial of service across exposed web interfaces without needing elevated credentials. Multiple Red Hat management consoles and backend services incorporate this library into their web frontends to process client requests. In standard deployments where these services accept untrusted network queries or payload data, handling specially crafted strings forces quadratic computation time and freezes the single-threaded execution loop, effectively preventing legitimate administrative access.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
When an attacker can directly invoke the blocking code, or the blocking code can be affected by environmental conditions that can be influenced by an attacker, then this can lead to a denial of service by causing unexpected hang or freeze of the code. An unexpected call to blocking code can trigger an infinite loop, or a large loop that causes the software to pause and wait indefinitely.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
