# CVE-2026-42371: uriparser numeric truncation in CompareRange

Source: https://junglewise.ai/threats/cve-2026-42371-uriparser-numeric-truncation-in-comparerange  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-27. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-42371 · Severity: medium · CVSS 5.1 · Published 2026-04-27

uriparser is a software library used by various applications to process and handle web addresses (URIs). A vulnerability exists where the library incorrectly handles extremely long web addresses (gigabytes in length), which can cause the application to crash or behave unexpectedly. This could lead to a service outage if an attacker provides a specially crafted, massive URI to a vulnerable system.

Technologies: [Uriparser Project Uriparser](https://junglewise.ai/threats/technologies/uriparser). Vendors: [Uriparser Project](https://junglewise.ai/threats/vendors/uriparser-project).

## Quick answers

**Is CVE-2026-42371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42371 being exploited in the wild.

**How severe is CVE-2026-42371?** Medium severity, with a CVSS score of 5.1, published 27 April 2026.

**Which products and versions are affected?** Uriparser Project Uriparser < 1.0.1.

**Is there a fix for CVE-2026-42371?** A patch was published on 2026-04-27: Version 1.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42371 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-42371?** Check whether you run Uriparser Project Uriparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A numeric truncation vulnerability (CWE-197) exists in the `CompareRange` function of uriparser before version 1.0.1. On 64-bit platforms, the library converted pointer-difference lengths to a 32-bit integer during comparison. If an application accepts URIs with lengths in the gigabyte range, this truncation can cause mismatched ranges to be incorrectly treated as having equal lengths. An attacker could potentially exploit this to cause a denial of service (crash) or logic errors in URI validation. The issue is fixed in version 1.0.1 by ensuring full range lengths are compared before content comparison.

## Affected products

- uriparser project uriparser < 1.0.1

## Timeline

- 2026-04-22: other: Fix developed in GitHub pull request
- 2026-04-27: disclosed: Public disclosure on oss-security mailing list
- 2026-04-27: patched: Version 1.0.1 released
- 2026-04-27: advisory: CVE-2026-42371 assigned

## References

- [https://github.com/uriparser/uriparser/pull/298](https://github.com/uriparser/uriparser/pull/298)
- [https://uriparser.github.io/](https://uriparser.github.io/)
- [http://www.openwall.com/lists/oss-security/2026/04/27/2](http://www.openwall.com/lists/oss-security/2026/04/27/2)

## Related threats

- [uriparser incorrect URI comparison in EqualsUri](https://junglewise.ai/threats/cve-2026-44928-uriparser-incorrect-uri-comparison-in-equalsuri)
- [uriparser numeric truncation in pointer calculations](https://junglewise.ai/threats/cve-2026-44927-uriparser-numeric-truncation-in-pointer-calculations)