Bug 2537710

Summary:	CVE-2026-86472 python-jupytext: fast-uri: Security bypass due to inconsistent host case normalization [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Ganesh <gnaik>
Component:	python-jupytext	Assignee:	Jerry James <loganjerry>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	loganjerry
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["b4febcb2-0a64-4cd6-8e6e-0b68443ecd9e"]}
Fixed In Version:	python-jupytext-1.19.6-1.fc44 python-jupytext-1.19.6-1.fc43	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-14 01:24:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2533679

Description Ganesh 2026-09-22 05:39:24 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.

Comment 1 Fedora Update System 2026-10-05 19:45:11 UTC

FEDORA-2026-3942ab86fd (python-jupytext-1.19.6-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3942ab86fd

Comment 2 Fedora Update System 2026-10-06 01:24:13 UTC

FEDORA-2026-8b0bf60fcb has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-8b0bf60fcb`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8b0bf60fcb

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 3 Fedora Update System 2026-10-06 01:57:10 UTC

FEDORA-2026-620e232420 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-620e232420`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-620e232420

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-10-06 02:26:50 UTC

FEDORA-2026-3942ab86fd has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3942ab86fd`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3942ab86fd

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-14 01:24:53 UTC

FEDORA-2026-620e232420 (python-jupytext-1.19.6-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2026-10-14 01:31:32 UTC

FEDORA-2026-3942ab86fd (python-jupytext-1.19.6-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.