CVE-2026-110095

A flaw was found in fast-uri. The library improperly applies dot-segment removal to relative Uniform Resource Identifier (URI) paths during normalization, causing leading parent-directory segments to be discarded. A remote attacker could supply a crafted relative path to an application that relies on fast-uri for resolution, caching, or authorization. This can cause the reference to escape its intended directory, potentially allowing unauthorized access to restricted resources.

This vulnerability is rated as having a Low impact because exploitation requires an application to specifically pass untrusted relative paths to URI normalization or serialization routines prior to base resolution or access control checks. Within Red Hat products, fast-uri is primarily present as an indirect dependency in web consoles, dashboard interfaces, and frontend tooling. Typical product deployments do not expose authorization or routing workflows that rely on standalone relative URI normalization of untrusted input, substantially limiting the attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.