Interpretation Conflict in fast-uri - CVE-2026-18446

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140701

Interpretation Conflict in fast-uri - CVE-2026-18446

Published: August 1, 2026


Vulnerability identifier: #VU140701
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18446
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass host-based policy checks and steer requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URI parser when parsing references that use backslash-based authority introducers. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and steer requests to an unintended destination.

The issue arises from inconsistent host extraction between fast-uri and Node's WHATWG URL handling for special schemes.


Affected software

fast-uri
ApplinX
webMethods API Gateway
Data Cataloging
QRadar Threat Intelligence
IBM Fusion HCI
Bitbucket Data Center
Bamboo Data Center
Jira Service Management Data Center
Jira Software Data Center
Informix Dynamic Server

How to mitigate CVE-2026-18446

Install security update from vendor's website.

fast-uri - addressed in versions 2.4.4, 3.1.5, 4.1.2
IBM Fusion HCI - update to 2.14.0
Bitbucket Data Center - update to 9.4.23
Bamboo Data Center - update to 10.2.22
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.1
Jira Software Data Center - addressed in versions 10.3.25, 11.3.1
webMethods API Gateway - update to 11.1 Fix13
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16

External References

Related Security Bulletins