Monthly
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? crossing ? delimiters) rather than a global gsub with a constrained character class, a single crafted encoded-word could swallow surrounding text, enabling apparent sender spoofing, phishing, and authorization-check bypass in any Ruby application relying on these decoded values for trust decisions. No public exploit or KEV listing is present at time of analysis, and the fix is confirmed in version 2.9.1.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. victim<!--x-->attacker), the value authentik reads for user matching is truncated to the text before the comment while the IdP's signed assertion still validates, because comment-excluding canonicalization (xml-exc-c14n) strips the comment before the signature digest is computed. This binds the attacker's external identity to the victim's existing account without the victim's password or the IdP private key, and the malicious link persists across future logins. No public exploit identified at time of analysis; the flaw is fixed upstream and demonstrated by regression tests in the vendor patch.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing internationalized domain names (IDNs) under IDNA 2003. The module incorrectly applies modern Unicode codepoint attributes - Unicode 17.0.0 in the fixed version - instead of the Unicode 3.2.0 attributes mandated by RFC 3454, causing incorrect case-folding behavior via in_table_b2() and related functions. Applications using Python's idna codec for domain validation or access control are at risk of domain identity confusion for a subset of IDN labels containing characters whose Unicode properties changed after Unicode 3.2.0. A vendor fix is available via CPython PR #155293; no public exploit has been identified at time of analysis.
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. No public exploit has been identified at time of analysis, but the bypass mechanism is mechanistically straightforward, requiring only knowledge of the quote-handling discrepancy to exploit via the network with low-privilege credentials.
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers to bypass operator-configured denyPatterns and achieve arbitrary command execution. The bridge evaluates security patterns against only the first 500 characters of a submitted Bash command field while Claude Code receives and executes the full, untruncated string - meaning any payload positioned past byte 500 is invisible to the deny list but fully executable by the runtime. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 base score of 8.7 and low attack complexity signal that operationalizing this bypass requires minimal skill once low-privilege bridge access is obtained.
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the `backfill_id` path parameter with Python's `int()` while the route handler declared `NonNegativeInt` via Pydantic, which in lax mode coerces inputs like `'42.0'` that `int()` rejects-causing the two components to authorize and act on different DAGs. Backfill IDs are sequential, making cross-DAG enumeration trivial; no public exploit code has been identified at time of analysis, though the technique is directly reproducible from the published patch diff.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.
Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? crossing ? delimiters) rather than a global gsub with a constrained character class, a single crafted encoded-word could swallow surrounding text, enabling apparent sender spoofing, phishing, and authorization-check bypass in any Ruby application relying on these decoded values for trust decisions. No public exploit or KEV listing is present at time of analysis, and the fix is confirmed in version 2.9.1.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Account takeover in authentik (goauthentik) identity provider before 2026.2.6 and 2026.5.5 allows an attacker holding an account on an upstream SAML identity provider to hijack a victim's authentik account. By injecting an XML comment into the SAML NameID (e.g. victim<!--x-->attacker), the value authentik reads for user matching is truncated to the text before the comment while the IdP's signed assertion still validates, because comment-excluding canonicalization (xml-exc-c14n) strips the comment before the signature digest is computed. This binds the attacker's external identity to the victim's existing account without the victim's password or the IdP private key, and the malicious link persists across future logins. No public exploit identified at time of analysis; the flaw is fixed upstream and demonstrated by regression tests in the vendor patch.
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing internationalized domain names (IDNs) under IDNA 2003. The module incorrectly applies modern Unicode codepoint attributes - Unicode 17.0.0 in the fixed version - instead of the Unicode 3.2.0 attributes mandated by RFC 3454, causing incorrect case-folding behavior via in_table_b2() and related functions. Applications using Python's idna codec for domain validation or access control are at risk of domain identity confusion for a subset of IDN labels containing characters whose Unicode properties changed after Unicode 3.2.0. A vendor fix is available via CPython PR #155293; no public exploit has been identified at time of analysis.
SandboxPolicy bypass in Network-AI (versions before 5.15.1) enables authenticated attackers to execute arbitrary blocked commands by exploiting a parsing discrepancy between the policy engine and the command executor. The SandboxPolicy evaluates raw command strings with quotes intact, passing them through blocklist and approval-gate checks, while the executor subsequently strips those quotes during tokenization and runs the actual dangerous argv. No public exploit has been identified at time of analysis, but the bypass mechanism is mechanistically straightforward, requiring only knowledge of the quote-handling discrepancy to exploit via the network with low-privilege credentials.
Truncation-induced interpretation conflict in Network-AI ClaudeHookBridge before 5.15.1 enables low-privileged attackers to bypass operator-configured denyPatterns and achieve arbitrary command execution. The bridge evaluates security patterns against only the first 500 characters of a submitted Bash command field while Claude Code receives and executes the full, untruncated string - meaning any payload positioned past byte 500 is invisible to the deny list but fully executable by the runtime. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 base score of 8.7 and low attack complexity signal that operationalizing this bypass requires minimal skill once low-privilege bridge access is obtained.
Security restriction bypass in IBM i 7.3 through 7.6 exploits an interpretation conflict in the multipart parser, enabling a remote attacker with high administrative privileges to circumvent configured access controls with low integrity impact. The flaw (CWE-436) arises when the security enforcement layer and the processing layer disagree on how to interpret multipart message boundaries, allowing carefully crafted requests to evade security checks. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Authorization bypass in Apache Airflow's Backfill API (all versions prior to 3.3.1) allows any authenticated user holding edit permission on a single DAG to read, pause, cancel, and fail backfills belonging to any other DAG. The flaw is a type-parsing mismatch in FastAPI's dependency resolution layer: the authorization dependency parsed the `backfill_id` path parameter with Python's `int()` while the route handler declared `NonNegativeInt` via Pydantic, which in lax mode coerces inputs like `'42.0'` that `int()` rejects-causing the two components to authorize and act on different DAGs. Backfill IDs are sequential, making cross-DAG enumeration trivial; no public exploit code has been identified at time of analysis, though the technique is directly reproducible from the published patch diff.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.