Homepage

CVE-2026-6321 The advisory has been revoked - it doesn't affect any version of package kibana-9.4-oci-entrypoint  (opens in a new tab)

Threat Intelligence

EPSS
0.77% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KIBANA94OCIENTRYPOINT-16719594
  • published17 May 2026
  • disclosed4 May 2026
Report a new vulnerability Found a mistake?

Introduced: 4 May 2026

CVE-2026-6321  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kibana-9.4-oci-entrypoint package and not the kibana-9.4-oci-entrypoint package as distributed by Minimos.

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.

References