Bug 2466582 (CVE-2026-6321)

Summary:	CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, abrianik, alizardo, anthomas, bdettelb, brasmith, caswilli, cdrage, chfoley, cmah, cochase, doconnor, dranck, dschmidt, eaguilar, ebaron, ehelms, erezende, ggainey, ggrzybek, jchui, jhe, jkoehler, jlanda, jolong, jraez, juwatts, jwong, kaycoth, kshier, ktsao, lphiri, manissin, mhulan, mstipich, nboldt, nmoumoul, oaljalju, omaciel, osousa, parichar, pcreech, pjindal, psrna, rchan, rexwhite, rgodfrey, rhel-process-autobot, rushinde, sdawley, simaishi, smallamp, smcdonal, stcannon, sthirugn, swoodman, tasato, teagle, tmalecek, ttakamiy, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2466942, 2466945, 2466946, 2466949, 2466951, 2466954, 2466941, 2466943, 2466944, 2466947, 2466948, 2466950, 2466952, 2466953
Bug Blocks:

Description OSIDB Bzimport 2026-05-04 20:01:37 UTC

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

Comment 3 errata-xmlrpc 2026-07-20 15:58:37 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:42078 https://access.redhat.com/errata/RHSA-2026:42078

Comment 4 errata-xmlrpc 2026-07-20 16:01:59 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:42079 https://access.redhat.com/errata/RHSA-2026:42079