Interpretation Conflict in fast-uri - CVE-2026-13676

Vulnerability identifier: #VU138918

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-13676

CWE-ID: CWE-436

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to fast-uri fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. A remote attacker can trigger the vulnerability to modify data on the system.

fast-uri
Event Processing
InfoSphere Optim Archive Viewer
MongoDB Enterprise Advanced with IBM
Data Cataloging
QRadar Threat Intelligence
IBM Fusion HCI
IBM Maximo Application Suite - Manage Component
Bitbucket Data Center
Bamboo Data Center
Jira Service Management Data Center
Jira Software Data Center
Ansible Automation Platform
Red Hat OpenShift Container Platform

Install updates from vendor's website.

fast-uri - addressed in versions 2.4.2, 3.1.3, 4.0.1
Event Processing - update to 1.5.5
IBM Fusion HCI - update to 2.14.0
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.28, 9.1.20, 9.2.1
Bitbucket Data Center - update to 9.4.23
Bamboo Data Center - update to 10.2.22
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.1
Jira Software Data Center - addressed in versions 10.3.25, 11.3.1
InfoSphere Optim Archive Viewer - update to 11.7.0.15
MongoDB Enterprise Advanced with IBM - update to 1.49.11
Ansible Automation Platform - update to 2.2.0
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
Red Hat OpenShift Container Platform - addressed in versions 4.19.39, 4.20.29, 4.21.24, 4.21.26

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6
• https://access.redhat.com/errata/RHSA-2026:37186
• https://access.redhat.com/errata/RHSA-2026:37585
• https://access.redhat.com/errata/RHSA-2026:37628
• https://access.redhat.com/errata/RHSA-2026:40118
• https://access.redhat.com/errata/RHSA-2026:40262
• https://access.redhat.com/errata/RHSA-2026:40945
• https://access.redhat.com/errata/RHSA-2026:41066
• https://access.redhat.com/security/cve/CVE-2026-13676
• https://bugzilla.redhat.com/show_bug.cgi?id=2494197
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json

• Interpretation Conflict in fast-uri
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in Ansible Automation Platform 2.2 packages
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• MongoDB Enterprise Advanced with IBM update for fast-uri
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Event Processing
• IBM InfoSphere Optim Archive Viewer update for fast-uri
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging