CVE-2026-42371 Integer overflow in uriparser

Medium 5.1 Published 27 Apr 2026 Updated 27 Apr 2026

Attackers can cause denial of service by submitting extremely large URIs, triggering numeric truncation in the uriparser library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-42371?

CVE-2026-42371 is a medium-severity vulnerability in uriparser, published on 27 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.

Weakness: CWE-197

Which versions are affected by CVE-2026-42371?

It affects 1 product.

Linux distribution packages (5)

`mingw32-uriparser` Red Hat:hummingbird:1	All versions	`0:1.0.1-1.hum1`
`mingw64-uriparser` Red Hat:hummingbird:1	All versions	`0:1.0.1-1.hum1`
`uriparser` Red Hat:hummingbird:1	All versions	`0:1.0.1-1.hum1`
`uriparser-devel` Red Hat:hummingbird:1	All versions	`0:1.0.1-1.hum1`
`uriparser-doc` Red Hat:hummingbird:1	All versions	`0:1.0.1-1.hum1`

Products include Uriparser Project Uriparser.

How do I fix CVE-2026-42371?

Upgrade to a fixed version.

Is CVE-2026-42371 being exploited?

There is no known exploitation of CVE-2026-42371 in the wild and no public exploit code.

Sources

Also known as AZL-84396, DEBIAN-CVE-2026-42371, ECHO-3740-13e8-652e, GHSA-3f6w-rmcx-pgmh, RHSA-2026:12430, ROOT-OS-DEBIAN-12-CVE-2026-42371 and 1 more.