Improper Handling of URL Encoding (Hex Encoding) in fast-uri - CVE-2026-76172

Vulnerability identifier: #VU145064

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-76172

CWE-ID: CWE-177

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass host validation and inject carriage return and line feed characters into output.

The vulnerability exists due to improper handling of url encoding in the scheme component normalization logic when normalizing or resolving untrusted URLs. A remote attacker can supply a specially crafted percent-encoded scheme to bypass host validation and inject carriage return and line feed characters into output.

Applications that treat a missing authority as same-origin during redirect checks, host allowlist enforcement, or outbound request decisions are particularly exposed.

fast-uri
webMethods API Gateway
ApplinX
InfoSphere Optim Archive Viewer
QRadar Threat Intelligence
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Bitbucket Data Center
Jira Software Data Center
Jira Service Management Data Center
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
cockpit-image-builder (Red Hat package)

Install security update from vendor's website.

fast-uri - addressed in versions 2.4.5, 3.1.6, 4.1.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Bitbucket Data Center - update to 9.4.23
Jira Software Data Center - addressed in versions 10.3.25, 11.3.1
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.1
webMethods API Gateway - update to 11.1 Fix13
InfoSphere Optim Archive Viewer - update to 11.7.0.15
QRadar Threat Intelligence - update to 2.6.0
cockpit-image-builder (Red Hat package) - update to 94.4-1.el10_2

• https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp

• Multiple vulnerabilities in fast-uri
• Multiple vulnerabilities in IBM ApplinX
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Red Hat Enterprise Linux 10 update for cockpit-image-builder
• Multiple vulnerabilities in Automation Assets in IBM Cloud Pak for Integration (CP4I)
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM webMethods API Gateway