Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-44928: Debian Linux: Unauthenticated Remote Code Execution
CVE-2026-44928 · published 6 months ago
Summary
A critical security issue affects Debian Linux systems, potentially allowing an attacker to execute malicious code on a vulnerable system without needing a password. This issue affects users who run Debian Linux and use a specific package, which is used to manage network connections. To protect your system, update your Debian Linux installation as soon as possible.
What to do
- Update debian rootio-uriparser to version 0.9.7+dfsg-2.root.io.3.
- Update debian uriparser to version 0.9.7+dfsg-2.aikido.5.
- Update debian rootio-uriparser to version 0.9.7+dfsg-2.aikido.5.
- Update uriparser_project uriparser to version 1.0.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:22.04:LTS | canonical | uriparser | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | uriparser | All versions |
| Ubuntu:25.10 | canonical | uriparser | All versions |
| Ubuntu:26.04:LTS | canonical | uriparser | All versions |
| Debian:11 | debian | uriparser | All versions |
| Debian:12 | debian | uriparser | All versions |
| Debian:13 | debian | uriparser | All versions |
| Debian:14 | debian | uriparser | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | uriparser | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | uriparser | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | uriparser | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | uriparser | All versions |
| Echo | echo | uriparser | All versions |
| Root:Debian:12 | debian | rootio-uriparser |
< 0.9.7+dfsg-2.root.io.3 < 0.9.7+dfsg-2.aikido.5 Fix: upgrade to 0.9.7+dfsg-2.root.io.3
|
| Root:Debian:12 | debian | uriparser |
< 0.9.7+dfsg-2.aikido.5 Fix: upgrade to 0.9.7+dfsg-2.aikido.5
|
| – | uriparser_project | uriparser |
< 1.0.2 cpe:2.3:a:uriparser_project:uriparser:*:*:*:*:*:*:*:* |
Original advisory text
ECHO-6775-52bc-cd81
In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
References
- https://security-tracker.debian.org/tracker/CVE-2026-44928 Vendor Advisory
- https://advisory.echohq.com/cve/CVE-2026-44928 URL
- https://ubuntu.com/security/CVE-2026-44928 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-44928 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44928... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44928 Vendor Advisory
- https://github.com/uriparser/uriparser/pull/305 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-670Always-Incorrect Control Flow Implementation
Timeline
Published8 May 2026
Updated29 Oct 2026
First seen8 May 2026
Sources
DEBIAN-CVE-2026-44928 · OSV
CVE-2026-44928 · NVD
ECHO-6775-52bc-cd81 · OSV
UBUNTU-CVE-2026-44928 · OSV
CVE-2026-44928 · OSV
Track software like this
Free during beta