Host-control bypass via decoded authority delimiters
Published May 5, 2026 · Updated Sep 10, 2026
Host confusion in fast-uri 2.4.0 and earlier and 3.0.0 through 3.1.1 allows remote attackers to bypass host controls via crafted URLs. The normalize() operation decodes percent-encoded delimiters in the host and serializes them as raw separators, turning an encoded at-sign into a userinfo separator that changes the destination host. Exploitation requires a consuming application to use untrusted URLs in normalization and host-validation or routing logic; the demonstrated consequence is redirection or request routing to an unintended authority.
Summary
What happened
Host confusion in fast-uri 2.4.0 and earlier and 3.0.0 through 3.1.1 allows remote attackers to bypass host controls via crafted URLs. The normalize() operation decodes percent-encoded delimiters in the host and serializes them as raw separators, turning an encoded at-sign into a userinfo separator that changes the destination host. Exploitation requires a consuming application to use untrusted URLs in normalization and host-validation or routing logic; the demonstrated consequence is redirection or request routing to an unintended authority.
The record
- CVE
- CVE-2026-6322
- Published
- May 5, 2026
- Updated
- Sep 10, 2026
- Vendor
- libuser Project
- Product
- Red Hat Quay
- Classifications
- CWE-436, CWE-140
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- May 5, 2026CVE publishedPublication date reported by the CVE source.
- Sep 10, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <1781878070
- Affected versionversion=0 <1781937357
- Affected versionversion=0 <1782487717
- Affected versionversion=0 <1783955846
- Affected versionversion=0 <1786181981
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Activity data is delayed. The latest report is Sep 28, 2026.
Weakness, pattern, technique
Public exploit references
- Authority-confusion input/output proof of conceptproof of concept · unverified
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Get started to see how Hinoki identifies affected software and validates exploitability in your environment.
Get started