debian/uriparser vulnerabilities

Latest debian/uriparser CVEs

Newest publication first

1. CVE-2026-44928 uriparser: uriparser: Incorrect URI comparison leading to integrity issues

   Published 2026-05-08

   Medium·CVSS 5.3 EPSS 0.21%

   In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

2. CVE-2026-44927 uriparser: uriparser: Data integrity issue due to pointer truncation

   Published 2026-05-08

   Medium·CVSS 5.3 EPSS 0.21%

   In uriparser before 1.0.2, there is pointer difference truncation to int in various places.

3. CVE-2026-42371 uriparser: uriparser: Denial of Service via numeric truncation with oversized URIs

   Published 2026-04-27

   Medium·CVSS 5.1 EPSS 0.17%

   uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.

4. CVE-2025-67899 uriparser: uriparser: Unbounded recursion and stack consumption via large input

   Published 2025-12-14

   Low·CVSS 2.9 EPSS 0.14%

   uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.

5. CVE-2024-34403 An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.

   Published 2024-05-03

   Medium·CVSS 5.9 EPSS 1.3%

   An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.

6. CVE-2024-34402 An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

   Published 2024-05-03

   High·CVSS 8.6 EPSS 1.2%

   An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

7. DSA-5063-1 uriparser - security update

   Published 2022-01-26

   Unknown

8. DLA-2883-2 uriparser - regression update

   Published 2022-01-26

   Unknown

9. DLA-2883-1 uriparser - security update

   Published 2022-01-17

   Unknown

10. CVE-2021-46141 An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.

    Published 2022-01-06

    Medium·CVSS 5.5 EPSS 1.2%

    An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.

11. CVE-2021-46142 An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

    Published 2022-01-06

    Medium·CVSS 5.5 EPSS 1.2%

    An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

12. DLA-2834-1 uriparser - security update

    Published 2021-11-30

    Unknown

13. DLA-1682-1 uriparser - security update

    Published 2019-02-18

    Unknown

14. CVE-2018-20721 URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::4...

    Published 2019-01-16

    Critical·CVSS 9.8 EPSS 2.1%

    URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.

15. DLA-1581-1 uriparser - security update

    Published 2018-11-20

    Unknown

16. CVE-2018-19200 An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

    Published 2018-11-12

    High·CVSS 7.5 EPSS 2.3%

    An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

17. CVE-2018-19199 An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

    Published 2018-11-12

    Critical·CVSS 9.8 EPSS 2.3%

    An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

18. CVE-2018-19198 An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain con...

    Published 2018-11-12

    Critical·CVSS 9.8 EPSS 2.4%

    An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.