EUVD-2026-25776Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.
AnalysisAI
uriparser before 1.0.1 suffers a numeric truncation vulnerability in text range comparison that causes denial of service when processing URIs with gigabyte-scale lengths. The flaw occurs because internal range comparisons truncate large numeric values, allowing maliciously crafted oversized URIs to bypass length validation and trigger memory exhaustion or processing failures. Local attackers can exploit this via specially constructed input, though practical exploitation requires an application to accept and process URIs of exceptional size.
Technical ContextAI
uriparser is a C library for parsing and validating Uniform Resource Identifiers (URIs) according to RFC 3986. The vulnerability stems from numeric truncation in text range comparison functions (CWE-197), where signed or unsigned integer overflow occurs when comparing URI component lengths. When a URI component claims a length approaching or exceeding gigabytes, internal integer variables truncate, causing the range check to underflow or bypass validation. This allows oversized buffers or memory regions to be accessed as if they were within valid bounds. The affected product is identified by CPE cpe:2.3:a:uriparser:uriparser:*:*:*:*:*:*:*:* with fix available in version 1.0.1 per GitHub PR #298.
RemediationAI
Upgrade uriparser to version 1.0.1 or later. This release fixes the numeric truncation in range comparison by properly handling large integer values during URI length validation. Applications should verify they are using the patched version via package manager or dependency scanning tools. As a temporary compensating control, if upgrade is delayed, restrict maximum URI length at the application or HTTP server layer - for example, set LimitRequestLine in Apache or client_max_body_size in nginx to a reasonable value (typically 8 KB or less for standard URIs), preventing gigabyte-scale inputs from reaching the parser. This mitigation reduces exploitability but does not address the underlying flaw and should not replace patching. Additionally, applications should validate URI length independently before passing to uriparser, ensuring local checks prevent the edge case of truncated numeric comparisons.
An issue was discovered in uriparser before 0.9.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
An issue was discovered in uriparser before 0.9.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
An issue was discovered in uriparser before 0.9.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
The EqualsUri function in uriparser before version 1.0.2 incorrectly classifies structurally distinct URIs as equivalent
Pointer difference truncation to signed int in uriparser before version 1.0.2 allows local attackers to cause integer ov
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP4 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
| openSUSE Leap 15.6 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today