CVE-2026-86472
Description
A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicious URI with a percent-encoded uppercase octet, potentially bypassing host allowlists or denylists in applications that rely on fast-uri's output for case-sensitive host decisions. This could lead to a security bypass, allowing access to restricted resources or services.
Statement
Moderate: A security bypass flaw was found in fast-uri due to inconsistent host case normalization. This issue allows an attacker to bypass host allowlist or denylist security checks in applications that perform case-sensitive host comparisons on fast-uri output, potentially leading to unauthorized access or actions.
Mitigation
Applications utilizing fast-uri for host validation should implement case-insensitive comparisons by converting the parsed host to lowercase before performing any allowlist or denylist checks. This ensures that variations in host casing, including percent-encoded uppercase octets, do not lead to security bypasses.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
