Executive brief
uriparser is a software library used by various applications to process and handle web addresses (URIs). A vulnerability exists where the library incorrectly handles extremely long web addresses (gigabytes in length), which can cause the application to crash or behave unexpectedly. This could lead to a service outage if an attacker provides a specially crafted, massive URI to a vulnerable system.
Technical details
A numeric truncation vulnerability (CWE-197) exists in the `CompareRange` function of uriparser before version 1.0.1. On 64-bit platforms, the library converted pointer-difference lengths to a 32-bit integer during comparison. If an application accepts URIs with lengths in the gigabyte range, this truncation can cause mismatched ranges to be incorrectly treated as having equal lengths. An attacker could potentially exploit this to cause a denial of service (crash) or logic errors in URI validation. The issue is fixed in version 1.0.1 by ensuring full range lengths are compared before content comparison.
Affected products
- uriparser project uriparser < 1.0.1
Timeline
- 2026-04-22: other: Fix developed in GitHub pull request
- 2026-04-27: disclosed: Public disclosure on oss-security mailing list
- 2026-04-27: patched: Version 1.0.1 released
- 2026-04-27: advisory: CVE-2026-42371 assigned