Read the docs
TI-2026-32795 Aliases CVE-2026-44928GHSA-xw5w-xhjv-gf29

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

Priority LOW 23CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Partial uriparser (uriparser): 1.0.2Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
uriparseruriparserbefore 1.0.21.0.2Patch availableCNA
  • uriparser Vendoruriparser Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:uriparser_project:uriparser:*:*:*:*:*:*:*:*before 1.0.2Vulnerableuriparser
  • cpe:2.3:a:uriparser_project:uriparser:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·uriparser

Remediation

  • Fix · CNA uriparser (uriparser) Fixed in 1.0.2

Red Hat 1 advisory

  • RHSA-2026:16341 Released 2026-05-12 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images mingw32-uriparser-1.0.2-1.hum1@noarch@public-hummingbird-aarch64-rpms, mingw32-uriparser-1.0.2-1.hum1@noarch@public-hummingbird-x86_64-rpms, mingw64-uriparser-1.0.2-1.hum1@noarch@public-hummingbird-aarch64-rpms +8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    uriparser 1.0.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-32794 In uriparser before 1.0.2, there is pointer difference truncation to int in various places.Priority LOW 23
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:16341

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44928
  2. 2026-10-03 Alias added: GHSA-xw5w-xhjv-gf29

References

Patch 1

  • TI-2018-13621 An issue was discovered in uriparser before 0.9.0. CVSS 3.0CRITICAL 9.8
  • TI-2018-13620 An issue was discovered in uriparser before 0.9.0. CVSS 3.0CRITICAL 9.8
  • TI-2024-22740 An issue was discovered in uriparser through 0.9.7. CVSS 3.1HIGH 8.6
  • TI-2018-14704 URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in… CVSS 3.1CRITICAL 9.8
  • TI-2018-13622 An issue was discovered in uriparser before 0.9.0. CVSS 3.0HIGH 7.5
  • TI-2024-22741 An issue was discovered in uriparser through 0.9.7. CVSS 3.1MEDIUM 5.9
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences