Summary
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.
Security Fix(es):
* fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)
* fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
* fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)
* fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | cockpit-image-builder | 0:94.4-1.el10_2 |
Vulnerabilities 4
-
High 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input int…
-
High 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a diffe…
-
High 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an…
-
High 7.5
fast-uri vulnerable to authority injection via an unvalidated port in serialize
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority de…