34 matches found
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.57 security and extras update
Red Hat OpenShift Container Platform release 4.18.57 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_71543)
The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202671543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery v...
AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)
The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery vi...
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...
NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize
NPM: fast-uri vulnerable to authority injection via an unvalidated port in serialize vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.6...
GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize
Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...
cockpit-image-builder security update
An update is available for cockpit-image-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The image-builder-frontend generates custom images suitable fo...
RLSA-2026:71543 Important: cockpit-image-builder security update
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fixes: fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri:...
RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)
The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory. fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri: fast-uri: Server-side request forgery v...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
Important: Red Hat Security Advisory: cockpit-image-builder security update
An update for cockpit-image-builder is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ALSA-2026:71543 Important: cockpit-image-builder security update
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fixes: fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75899 fast-uri:...
RHEL 10 : cockpit-image-builder (RHSA-2026:71543)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71543 advisory. The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.39 security and extras update
Red Hat OpenShift Container Platform release 4.20.39 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
SUSE CVE-2026-84292
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...
Improper Encoding or Escaping of Output
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but concatenates the port fie...