CVE-2026-13676
high
Red Hat CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
High
Availability
None
Vulnerability Report
Generated by CyberWatcher
Description
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
CWE
CWE-551Affected Products
Confidential Compute AttestationCryostat 4Migration Toolkit for Applications 8Migration Toolkit for ContainersMulticluster Engine for KubernetesNetwork Observability OperatorOpenShift LightspeedOpenShift PipelinesOpenShift ServerlessRed Hat Advanced Cluster Management for Kubernetes 2