Server-Side Request Forgery (SSRF) in fast-uri - CVE-2026-75975

Vulnerability identifier: #VU145066

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-75975

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass host-policy checks and perform server-side request forgery.

The vulnerability exists due to improper input validation in the IPv6 literal normalization logic of fast-uri when normalizing untrusted URLs containing malformed bracketed IPv6 literals. A remote attacker can supply a specially crafted URL to bypass host-policy checks and perform server-side request forgery.

Malformed bracketed IPv6 literals with invalid trailing text are silently truncated to different valid IPv6 addresses, and parse().error is not set for these inputs.

fast-uri
webMethods API Gateway
ApplinX
InfoSphere Optim Archive Viewer
QRadar Threat Intelligence
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Bitbucket Data Center
Jira Software Data Center
Jira Service Management Data Center
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
cockpit-image-builder (Red Hat package)

Install security update from vendor's website.

fast-uri - addressed in versions 2.4.5, 3.1.6, 4.1.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Bitbucket Data Center - update to 9.4.23
Jira Software Data Center - addressed in versions 10.3.25, 11.3.1
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.1
webMethods API Gateway - update to 11.1 Fix13
InfoSphere Optim Archive Viewer - update to 11.7.0.15
QRadar Threat Intelligence - update to 2.6.0
cockpit-image-builder (Red Hat package) - update to 94.4-1.el10_2

• https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc

• Multiple vulnerabilities in fast-uri
• Multiple vulnerabilities in IBM ApplinX
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Red Hat Enterprise Linux 10 update for cockpit-image-builder
• Multiple vulnerabilities in Automation Assets in IBM Cloud Pak for Integration (CP4I)
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM webMethods API Gateway