CVE-2026-110306

A flaw was found in fast-uri. The library incorrectly decodes percent-encoded characters in protocol schemes prior to validation, causing invalid or prohibited schemes to be accepted as valid. A remote attacker can exploit this vulnerability by submitting a specially crafted Uniform Resource Identifier (URI) to bypass application allowlists, potentially leading to Cross-Site Scripting (XSS) if the normalized output is rendered in a web browser.

This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires user interaction to execute cross-site scripting in a browser and does not permit direct server-side compromise or privilege escalation. The flaw affects application environments that rely on fast-uri to parse and normalize untrusted URIs without performing downstream output sanitization. In many Red Hat web user interfaces and console plugins, overall exposure is further constrained by framework-level sanitization and browser security controls such as Content Security Policy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.