PT-2026-35358 · Uriparser · Uriparser

Worwin · Published 2026-04-27 · Updated 2026-05-18 · CVE-2026-42371

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions uriparser versions prior to 1.0.1

Description Numeric truncation occurs during text range comparison when an application accepts URIs with a length in gigabytes. This issue is characterized as an integer overflow, which happens when a numeric value exceeds the maximum capacity of the data type used to store it.

Recommendations Update to version 1.0.1.

Fix

Weakness Enumeration

CWE-197

Related Identifiers

CVE-2026-42371

ECHO-3740-13E8-652E

OESA-2026-2187

OESA-2026-2188

OESA-2026-2229

OESA-2026-2230

OESA-2026-2231

OPENSUSE-SU-2026:10747-1

RHSA-2026:12430

Affected Products

Uriparser

References · 38

• https://github.com/uriparser/uriparser/pull/298 · Patch
• https://osv.dev/vulnerability/OESA-2026-2187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42371 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-42371 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67899 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2230 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42371 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42371 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42371 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2188 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10747-1 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2188 · Note