Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
uriparser: Incorrect Parsing of URLs
published 5 months ago
Summary
uriparser, a library used by various applications and systems, had issues with parsing URLs. These issues could cause incorrect results or misclassify URLs, potentially leading to security problems. Affected users should update to the latest version of uriparser to fix these issues.
What to do
- Update openeuler uriparser to version 1.0.1-2.oe2203sp4.
- Update openeuler uriparser to version 1.0.1-2.oe2403sp1.
- Update openeuler uriparser to version 1.0.1-2.oe2403sp3.
- Update openeuler uriparser to version 1.0.1-2.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | uriparser |
< 1.0.1-2.oe2203sp4 Fix: upgrade to 1.0.1-2.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | uriparser |
< 1.0.1-2.oe2403sp1 Fix: upgrade to 1.0.1-2.oe2403sp1
|
| openEuler:24.03-LTS-SP3 | openeuler | uriparser |
< 1.0.1-2.oe2403sp3 Fix: upgrade to 1.0.1-2.oe2403sp3
|
| openEuler:20.03-LTS-SP4 | openeuler | uriparser |
< 1.0.1-2.oe2003sp4 Fix: upgrade to 1.0.1-2.oe2003sp4
|
| openEuler:24.03-LTS | openeuler | uriparser |
< 1.0.1-2.oe2403sp1 Fix: upgrade to 1.0.1-2.oe2403sp1
|
Original advisory text
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89(&quot;ANSI C&quot;). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
In uriparser before 1.0.2, there is pointer difference truncation to int in various places.(CVE-2026-44927)
In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.(CVE-2026-44928)
Security Fix(es):
In uriparser before 1.0.2, there is pointer difference truncation to int in various places.(CVE-2026-44927)
In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.(CVE-2026-44928)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44927 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44928 Vendor Advisory
Timeline
Published15 May 2026
Updated15 May 2026
First seen15 May 2026
Sources
OESA-2026-2301 · OSV
Track software like this
Free during beta