fast-uri vulnerable to host confusion via failed IDN canonicalization
Summary
| CVE | CVE-2026-13676 |
|---|---|
| State | PUBLISHED |
| Assigner | openjs |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-29 14:16:47 UTC |
| Updated | 2026-09-02 13:17:06 UTC |
| Description | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.002740000 probability, percentile 0.191560000 (date 2026-07-04)
Problem Types: CWE-436 | CWE-551 | CWE-436 CWE-436: Interpretation Conflict | CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | ce714d77-add3-4f53-aff5-83d477b104bb | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Fast-uri | Fast-uri | affected 4.0.0 4.0.1 semver | Not specified |
| CNA | Fast-uri | Fast-uri | unaffected 4.0.1 semver | Not specified |
| CNA | Fast-uri | Fast-uri | affected 2.3.1 3.1.3 semver | Not specified |
| CNA | Fast-uri | Fast-uri | unaffected 3.1.3 semver | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:1.1.2-1.el10_2 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.2 | unaffected 1787593647 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.2 | unaffected 1787597578 * rpm | Not specified |
| ADP | Red Hat | Cluster Observability Operator 1.5.2 | unaffected 1787597621 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.11 | unaffected 1786911977 * rpm | Not specified |
| ADP | Red Hat | Multicluster Engine For Kubernetes 2.17 | unaffected 1786668856 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.16 | unaffected 1786908361 * rpm | Not specified |
| ADP | Red Hat | Red Hat Advanced Cluster Management For Kubernetes 2.17 | unaffected 1787335105 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.2 | unaffected 1784622951 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.6 | unaffected 1785773509 * rpm | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2.7 | unaffected 1785413994 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785332487 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785340831 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785332825 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785332668 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785332694 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.10 | unaffected 1785411652 * rpm | Not specified |
| ADP | Red Hat | Red Hat Developer Hub 1.9 | unaffected 1784210921 * rpm | Not specified |
| ADP | Red Hat | Red Hat Discovery 2 | unaffected 1786634825 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194938 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784194574 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784126822 * rpm | Not specified |
| ADP | Red Hat | Red Hat Edge Manager 1.1 | unaffected 1784127736 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit 1.8 | unaffected 1783690532 * rpm | Not specified |
| ADP | Red Hat | Red Hat Migration Toolkit For Applications 8.2 | unaffected 1784109883 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787347991 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787250508 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787251550 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1786611759 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787251250 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787250617 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI 3.4 | unaffected 1787121387 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.16 | unaffected 1785530656 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.17 | unaffected 1784744859 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.19 | unaffected 1784144829 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.20 | unaffected 1783596795 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.21 | unaffected 1783510956 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.21 | unaffected 1784728481 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.22 | unaffected 1783559447 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4.22 | unaffected 1784729919 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705347 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706101 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705558 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705646 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706138 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705741 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705777 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705802 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786705938 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706577 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706125 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706177 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706188 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706679 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706357 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706612 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706644 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706659 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.18 | unaffected 1786706880 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701839 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786701555 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702052 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702713 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702264 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702448 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702276 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702440 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702315 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703071 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702563 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702636 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703137 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702716 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702872 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702949 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786702917 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.19 | unaffected 1786703143 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627460 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786626399 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628235 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627106 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629761 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627559 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786687918 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629478 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628142 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786631508 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628053 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627382 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627430 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629076 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786627469 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786644072 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786688215 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628340 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628623 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786632256 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786628935 * rpm | Not specified |
| ADP | Red Hat | Red Hat Openshift Data Foundation 4.2 | unaffected 1786629548 * rpm | Not specified |
| ADP | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | unaffected 1784737150 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.16 | unaffected 1783955846 * rpm | Not specified |
| ADP | Red Hat | Red Hat Quay 3.9 | unaffected 1784125838 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1785776190 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1785762027 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.18 | unaffected 1785922764 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.19 | unaffected 1785956497 * rpm | Not specified |
| ADP | Red Hat | Red Hat Satellite 6.19 | unaffected 1785937325 * rpm | Not specified |
| ADP | Red Hat | Confidential Compute Attestation | Not specified | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Cryostat 4 | Not specified | Not specified |
| ADP | Red Hat | Network Observability Operator | Not specified | Not specified |
| ADP | Red Hat | Network Observability Operator | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Lightspeed | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Pipelines | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | OpenShift Serverless | Not specified | Not specified |
| ADP | Red Hat | Red Hat AMQ Broker 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Ansible Automation Platform 2 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apache Camel - HawtIO 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Apicurio Registry 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Build Of Podman Desktop | Not specified | Not specified |
| ADP | Red Hat | Red Hat Connectivity Link 1 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Data Grid 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux AI RHEL AI 3 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift AI RHOAI | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat OpenShift Virtualization 4 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Satellite 6 | Not specified | Not specified |
| ADP | Red Hat | Self-service Automation Portal 2 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:40118 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57194 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57191 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:61314 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:47728 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| cna.openjsf.org/security-advisories.html | ce714d77-add3-4f53-aff5-83d477b104bb | cna.openjsf.org | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:41928 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:43038 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57013 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:51349 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:44268 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:42815 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37186 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40945 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:44239 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-13676 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:60386 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:51196 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:50479 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:40262 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:57590 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:59593 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:50758 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:54760 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:49642 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:48126 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:51197 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37585 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:51348 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41929 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:51342 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:40765 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:56366 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:48124 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:60520 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:41066 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6 | ce714d77-add3-4f53-aff5-83d477b104bb | github.com | Patch, Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:56431 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:37628 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:50340 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: celinke97 (en)
CNA: UlisesGascon (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-06-29T14:01:55.592Z | Reported to Red Hat. |
| ADP | 2026-06-29T13:22:44.674Z | Made public. |
Solutions
ADP: RHSA-2026:61314: Cluster Observability Operator 1.5.2
ADP: RHSA-2026:57590: Red Hat Enterprise Linux Extensions Channel (v. 10)
ADP: RHSA-2026:57191: Red Hat Advanced Cluster Management for Kubernetes 2.16
ADP: RHSA-2026:60386: Red Hat Advanced Cluster Management for Kubernetes 2.17
ADP: RHSA-2026:42815: Red Hat Ansible Automation Platform 2.2
ADP: RHSA-2026:50479: Red Hat Ansible Automation Platform 2.6
ADP: RHSA-2026:50340: Red Hat Ansible Automation Platform 2.7
ADP: RHSA-2026:48126: Red Hat Developer Hub 1.10
ADP: RHSA-2026:49642: Red Hat Developer Hub 1.10
ADP: RHSA-2026:41929: Red Hat Developer Hub 1.9
ADP: RHSA-2026:54760: Red Hat Discovery 2
ADP: RHSA-2026:40945: Red Hat Edge Manager 1.1
ADP: RHSA-2026:40118: Red Hat Edge Manager 1.1
ADP: RHSA-2026:41928: Red Hat Migration Toolkit 1.8
ADP: RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2
ADP: RHSA-2026:60520: Red Hat OpenShift AI 3.4
ADP: RHSA-2026:50758: Red Hat OpenShift Container Platform 4.16
ADP: RHSA-2026:47728: Red Hat OpenShift Container Platform 4.17
ADP: RHSA-2026:40765: Red Hat OpenShift Container Platform 4.19
ADP: RHSA-2026:37628: Red Hat OpenShift Container Platform 4.20
ADP: RHSA-2026:44268: Red Hat OpenShift Container Platform 4.21
ADP: RHSA-2026:37186: Red Hat OpenShift Container Platform 4.21
ADP: RHSA-2026:44239: Red Hat OpenShift Container Platform 4.22
ADP: RHSA-2026:37585: Red Hat OpenShift Container Platform 4.22
ADP: RHSA-2026:48124: Red Hat OpenShift Dev Spaces 3.29
ADP: RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18
ADP: RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19
ADP: RHSA-2026:57013: Red Hat Openshift Data Foundation 4.2
ADP: RHSA-2026:41066: Red Hat Quay 3.16
ADP: RHSA-2026:40262: Red Hat Quay 3.9
ADP: RHSA-2026:51342: Red Hat Satellite 6.18
ADP: RHSA-2026:51349: Red Hat Satellite 6.18
ADP: RHSA-2026:51348: Red Hat Satellite 6.18
ADP: RHSA-2026:51196: Red Hat Satellite 6.19
ADP: RHSA-2026:51197: Red Hat Satellite 6.19
ADP: RHSA-2026:57194: multicluster engine for Kubernetes 2.11
ADP: RHSA-2026:59593: multicluster engine for Kubernetes 2.17
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.