Is CVE-2026-44927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44927 being exploited in the wild.

How severe is CVE-2026-44927?

Low severity, with a CVSS score of 2.9, published 8 May 2026.

Which products and versions are affected?

Uriparser Project Uriparser < 1.0.2.

Is there a fix for CVE-2026-44927?

A patch was published on 2026-05-08: Version 1.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44927 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-44927?

Check whether you run Uriparser Project Uriparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44927: uriparser numeric truncation in pointer calculations

Q: Is there a fix for CVE-2026-44927?

A patch was published on 2026-05-08: Version 1.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44927 attacked?

It is attacked over the network or with local access, in a software library.

Q: Am I affected by CVE-2026-44927?

Check whether you run Uriparser Project Uriparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44927 · Severity: low · CVSS 2.9 · Published 2026-05-08

uriparser is a software library used by many applications to handle and process web addresses (URIs). A flaw in how the library calculates the distance between memory locations could lead to data being processed incorrectly. While the risk is low, it could potentially allow for minor data manipulation in applications that rely on this library for URI parsing.

Technologies: Uriparser Project Uriparser. Vendors: Uriparser Project.

Quick answers

Is CVE-2026-44927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44927 being exploited in the wild.
How severe is CVE-2026-44927?: Low severity, with a CVSS score of 2.9, published 8 May 2026.
Which products and versions are affected?: Uriparser Project Uriparser < 1.0.2.
Is there a fix for CVE-2026-44927?: A patch was published on 2026-05-08: Version 1.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44927 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-44927?: Check whether you run Uriparser Project Uriparser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A numeric truncation vulnerability (CWE-197) exists in uriparser versions prior to 1.0.2. The library incorrectly truncates 'ptrdiff_t' values to 'int' in several functions, including UriCommon.c (CopyRange, RemoveDotSegmentsEx) and UriQuery.c (AppendQuery). This occurs when calculating the distance between pointers, which on 64-bit systems can exceed the capacity of a 32-bit integer. An attacker could potentially exploit this to cause unexpected behavior or minor data integrity issues during URI parsing. The issue is resolved in version 1.0.2 by ensuring pointer differences are handled using appropriate data types.

Affected products

uriparser project uriparser < 1.0.2

Timeline

2026-05-04: other: Fixes submitted via pull request 304
2026-05-08: disclosed: CVE published
2026-05-08: patched: Version 1.0.2 released

References

https://github.com/uriparser/uriparser/pull/304

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.