Homepage

Improper Neutralization The advisory has been revoked - it doesn't affect any version of package sgx-common  (opens in a new tab)

Threat Intelligence

EPSS
0.48% (38th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-SGXCOMMON-17274364
  • published10 Jun 2026
  • disclosed5 May 2026
Report a new vulnerability Found a mistake?

Introduced: 5 May 2026

CVE-2026-6322  (opens in a new tab)
CWE-140  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream sgx-common package and not the sgx-common package as distributed by Centos.

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with the at-sign as a raw userinfo separator, changing the URI's authority to the second domain. Applications that normalize untrusted URLs before host allowlist checks, redirect validation, or outbound request routing can be steered to a different authority than the input appeared to specify. Versions <= 3.1.1 are affected. Update to 3.1.2 or later.

References