CVE-2026-110725

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting (XSS) by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers (URIs) using the suffix reference option. Because the library fails to properly escape colons in the first path segment of relative paths, the generated string can be misinterpreted by downstream components as an absolute URI with an executable scheme.

This vulnerability is rated as having a Low impact because exploitation is constrained to applications invoking specific non-default parsing configurations on untrusted input without scheme authority. Across Red Hat products, this library is primarily embedded as an internal dependency within build pipelines and administrative web consoles, where user-controlled relative URIs are not handled using this specialized setting. Consequently, the likelihood of triggering cross-site scripting or URI misinterpretation in default deployments is minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.