Every CVE Search/ Get API key

CVE-2021-46142

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in...

5.5 MediumFix available

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.17%Up 0.5 points since Jan 6, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
CVE-2021-46142
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
CVE-2021-46142
Updated
2026-11-02
EUVDEUVD-2021-32842 No score

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
EUVD-2021-32842
Updated
2026-11-03
GitHub AdvisoriesGHSA-5jh9-cx9r-v7ww No score

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in...

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
GHSA-5jh9-cx9r-v7ww
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2021-46142 5.5

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
ALPINE-CVE-2021-46142
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.5

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
CVE-2021-46142
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2021-46142 5.5

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
DEBIAN-CVE-2021-46142
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-1505 5.5

uriparser security update

The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.

Security Fix(es):

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.(CVE-2021-46141)

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.(CVE-2021-46142)

Record
OESA-2022-1505
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-46142 5.5

An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

Record
UBUNTU-CVE-2021-46142
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11727-1 No score

liburiparser1-0.9.6-1.1 on GA media

These are all security issues fixed in the liburiparser1-0.9.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11727-1
Updated
2026-11-02
OSVUSN-5256-1 No score

uriparser vulnerabilities

It was discovered that uriparser incorrectly handled certain memory operations. An attacker could use this to cause a denial of service. (CVE-2021-46141, CVE-2021-46142)

Record
USN-5256-1
Updated
2026-11-02
OSVUSN-5256-2 No score

uriparser vulnerabilities

USN-5256-1 fixed several vulnerabilities in uriparser. This update provides the corresponding update for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.

Original advisory details:

It was discovered that uriparser incorrectly handled certain memory operations. An attacker could use this to cause a denial of service. (CVE-2021-46141, CVE-2021-46142)

Record
USN-5256-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
uriparser
Alpine:v3.15
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.16
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.17
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.18
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.19
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.20
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.21
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.22
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.23
 before 0.9.6-r0
0.9.6-r0
uriparser
Alpine:v3.24
 before 0.9.6-r0
0.9.6-r0
Show 18 moreShow less
Affected packages
PackageAffectedFixed
uriparser
Debian:12
 before 0.9.6+dfsg-1
0.9.6+dfsg-1
uriparser
Debian:13
 before 0.9.6+dfsg-1
0.9.6+dfsg-1
uriparser
Debian:14
 before 0.9.6+dfsg-1
0.9.6+dfsg-1
uriparser
Debian:9
From an advisory covering 2 CVEs
 before 0.8.4-1+deb9u3, plus listed versions
0.8.4-10.8.4-1+deb9u10.8.4-1+deb9u2
0.8.4-1+deb9u3
uriparser
Debian:10
From an advisory covering 2 CVEs
 before 0.9.1-1+deb10u1, plus listed versions
0.9.1-1
0.9.1-1+deb10u1
uriparser
Debian:11
From an advisory covering 2 CVEs
 before 0.9.4+dfsg-1+deb11u1, plus listed versions
0.9.4+dfsg-1
0.9.4+dfsg-1+deb11u1
uriparser
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 0.9.6-1.oe1
0.9.6-1.oe1
uriparser
openEuler:20.03-LTS-SP2
From an advisory covering 2 CVEs
 before 0.9.6-1.oe1
0.9.6-1.oe1
uriparser
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 0.9.6-1.oe1
0.9.6-1.oe1
uriparser
Ubuntu:Pro:14.04:LTS
 before 0.7.5-1ubuntu2+esm3, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm10.7.5-1ubuntu2+esm2
0.7.5-1ubuntu2+esm3
uriparser
Ubuntu:Pro:16.04:LTS
 before 0.8.4-1ubuntu0.16.04.1~esm3, plus listed versions
0.8.2-10.8.3-10.8.4-10.8.4-1ubuntu0.16.04.1~esm2
0.8.4-1ubuntu0.16.04.1~esm3
uriparser
Ubuntu:18.04:LTS
 before 0.8.4-1+deb9u2ubuntu0.1, plus listed versions
0.8.4-10.8.4-1+deb9u2build0.18.04.1
0.8.4-1+deb9u2ubuntu0.1
uriparser
Ubuntu:Pro:20.04:LTS
 before 0.9.3-2ubuntu0.1~esm2, plus listed versions
0.9.3-2
0.9.3-2ubuntu0.1~esm2
uriparser
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 0.8.4-1+deb9u2ubuntu0.1, plus listed versions
0.8.4-10.8.4-1+deb9u2build0.18.04.1
0.8.4-1+deb9u2ubuntu0.1
uriparser
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 0.7.5-1ubuntu2+esm3, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm10.7.5-1ubuntu2+esm2
0.7.5-1ubuntu2+esm3
uriparser
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 0.8.4-1ubuntu0.16.04.1~esm3, plus listed versions
0.8.2-10.8.3-10.8.4-10.8.4-1ubuntu0.16.04.1~esm2
0.8.4-1ubuntu0.16.04.1~esm3
uriparser
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 0.9.3-2ubuntu0.1~esm2, plus listed versions
0.9.3-2
0.9.3-2ubuntu0.1~esm2
uriparser
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 0.9.6-1.1
0.9.6-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-46142 is a medium vulnerability (CVSS 5.5) in Uriparser Project Uriparser, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in uriparser 0.9.6-r0.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open