Executive brief
uriparser is a software library used by many applications to handle and process web addresses (URIs). A flaw in how the library calculates the distance between memory locations could lead to data being processed incorrectly. While the risk is low, it could potentially allow for minor data manipulation in applications that rely on this library for URI parsing.
Technical details
A numeric truncation vulnerability (CWE-197) exists in uriparser versions prior to 1.0.2. The library incorrectly truncates 'ptrdiff_t' values to 'int' in several functions, including UriCommon.c (CopyRange, RemoveDotSegmentsEx) and UriQuery.c (AppendQuery). This occurs when calculating the distance between pointers, which on 64-bit systems can exceed the capacity of a 32-bit integer. An attacker could potentially exploit this to cause unexpected behavior or minor data integrity issues during URI parsing. The issue is resolved in version 1.0.2 by ensuring pointer differences are handled using appropriate data types.
Affected products
- uriparser project uriparser < 1.0.2
Timeline
- 2026-05-04: other: Fixes submitted via pull request 304
- 2026-05-08: disclosed: CVE published
- 2026-05-08: patched: Version 1.0.2 released