2.9
CVSS
In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
Severity: LOW
📦
uriparser
Vendor: uriparser_project
Actively Exploited
0
CISA KEV List
PoC / Exploits
0
Code Available
Total RCEs
1
Remote Access
Total CVEs
12
Total Indexed
Avg. EPSS
1.33%
Exploit Prob.
Security Vulnerability Index
Page 1 / 2
2.9
CVSS
In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
Severity: LOW
5.1
CVSS
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.
Severity: MEDIUM
5.9
CVSS
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
Severity: MEDIUM
8.6
CVSS
An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.
Severity: HIGH
5.5
CVSS
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.
Severity: MEDIUM
5.5
CVSS
An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.
Severity: MEDIUM
9.8
CVSS
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Severity: CRITICAL
7.5
CVSS
An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.
Severity: HIGH
9.8
CVSS
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.
Severity: CRITICAL