CVE-2024-34403
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an...
CVE-2024-34403 is a medium vulnerability (CVSS 5.9) in Uriparser Project Uriparser, published May 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 70th percentile. Fixed in uriparser 0.9.8-3.
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
CVE-2024-34403- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2024-34768
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
EUVD-2024-34768- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c6h3-4727-9w7w
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an...
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
GHSA-c6h3-4727-9w7w- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
CVE-2024-34403- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
CVE-2024-34403- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-34403
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
DEBIAN-CVE-2024-34403- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2024-1534
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.(CVE-2024-34402)
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.(CVE-2024-34403)
- Record
OESA-2024-1534- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1627
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.(CVE-2024-34403)
- Record
OESA-2024-1627- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-34403
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
UBUNTU-CVE-2024-34403- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-43221 No score
CVE-2024-34403 affecting package uriparser for versions less than 0.9.8-3
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
AZL-43221- Updated
- 2026-11-02
OSVAZL-43228 No score
CVE-2024-34403 affecting package uriparser 0.9.7-2
An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.
- Record
AZL-43228- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13957-1 No score
liburiparser1-0.9.8-1.1 on GA media
These are all security issues fixed in the liburiparser1-0.9.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13957-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-34403 No score
CVE-2024-34403 in uriparser - Patched by Root
Root has patched CVE-2024-34403 in the uriparser package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2024-34403- Updated
- 2026-11-02
OSVSUSE-SU-2024:1860-1 No score
Security update for uriparser
This update for uriparser fixes the following issues:
- CVE-2024-34402: Fixed integer overflow protection in ComposeQueryEngine (bsc#1223887).
- CVE-2024-34403: Fixed integer overflow protection in ComposeQueryMallocExMm (bsc#1223888).
- Record
SUSE-SU-2024:1860-1- Updated
- 2026-11-02
OSVUSN-7356-1 No score
uriparser vulnerabilities
It was discovered that uriparser did not correctly handle certain inputs, which could lead to an integer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-34402, CVE-2024-34403)
- Record
USN-7356-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uriparserAzure Linux:3 |
before 0.9.8-3 | 0.9.8-3 |
uriparserAzure Linux:2 |
through 0.9.7-2 | None known |
uriparserDebian:12 |
All versions, plus listed versions 0.9.7+dfsg-20.9.8+dfsg-10.9.8+dfsg-21.0.1+dfsg-1 |
None known |
uriparserDebian:13 |
before 0.9.8+dfsg-1 | 0.9.8+dfsg-1 |
uriparserDebian:14 |
before 0.9.8+dfsg-1 | 0.9.8+dfsg-1 |
uriparseropenEuler:20.03-LTS-SP1 |
before 0.9.6-2.oe1 | 0.9.6-2.oe1 |
uriparseropenEuler:20.03-LTS-SP4 |
before 0.9.6-2.oe2003sp4 | 0.9.6-2.oe2003sp4 |
uriparseropenEuler:22.03-LTS |
before 0.9.6-2.oe2203sp2 | 0.9.6-2.oe2203sp2 |
uriparseropenEuler:22.03-LTS-SP1 |
before 0.9.6-2.oe2203sp1 | 0.9.6-2.oe2203sp1 |
uriparseropenEuler:22.03-LTS-SP2 |
before 0.9.6-2.oe2203sp2 | 0.9.6-2.oe2203sp2 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
uriparseropenEuler:22.03-LTS-SP3 |
before 0.9.6-2.oe2203sp3 | 0.9.6-2.oe2203sp3 |
uriparserRoot:Debian:12 |
before 0.9.7+dfsg-2.root.io.2 | 0.9.7+dfsg-2.root.io.20.9.7+dfsg-2.root.io.10.9.7+dfsg-2.root.io.40.9.7+dfsg-2.root.io.30.9.7+dfsg-2.aikido.5 |
rootio-uriparserRoot:Debian:12 |
before 0.9.7+dfsg-2.root.io.2 | 0.9.7+dfsg-2.root.io.20.9.7+dfsg-2.root.io.10.9.7+dfsg-2.root.io.40.9.7+dfsg-2.root.io.30.9.7+dfsg-2.aikido.5 |
uriparserSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 0.8.5-150000.3.8.1 | 0.8.5-150000.3.8.1 |
uriparserSUSE:Linux Enterprise Module for Package Hub 15 SP6 |
before 0.8.5-150000.3.8.1 | 0.8.5-150000.3.8.1 |
uriparseropenSUSE:Leap 15.5 |
before 0.8.5-150000.3.8.1 | 0.8.5-150000.3.8.1 |
uriparseropenSUSE:Leap 15.6 |
before 0.8.5-150000.3.8.1 | 0.8.5-150000.3.8.1 |
uriparserUbuntu:Pro:14.04:LTS |
before 0.7.5-1ubuntu2+esm4, plus listed versions 0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm10.7.5-1ubuntu2+esm20.7.5-1ubuntu2+esm3 |
0.7.5-1ubuntu2+esm4 |
uriparserUbuntu:Pro:16.04:LTS |
before 0.8.4-1ubuntu0.16.04.1~esm4, plus listed versions 0.8.2-10.8.3-10.8.4-10.8.4-1ubuntu0.16.04.1~esm20.8.4-1ubuntu0.16.04.1~esm3 |
0.8.4-1ubuntu0.16.04.1~esm4 |
uriparserUbuntu:Pro:18.04:LTS |
before 0.8.4-1+deb9u2ubuntu0.1+esm1, plus listed versions 0.8.4-10.8.4-1ubuntu0.18.04.1~esm20.8.4-1+deb9u2build0.18.04.10.8.4-1+deb9u2ubuntu0.1 |
0.8.4-1+deb9u2ubuntu0.1+esm1 |
uriparserUbuntu:Pro:20.04:LTS |
before 0.9.3-2ubuntu0.1~esm3, plus listed versions 0.9.3-20.9.3-2ubuntu0.1~esm2 |
0.9.3-2ubuntu0.1~esm3 |
uriparserUbuntu:Pro:22.04:LTS |
before 0.9.6+dfsg-1ubuntu0.1~esm1, plus listed versions 0.9.4+dfsg-10.9.5+dfsg-20.9.6+dfsg-1 |
0.9.6+dfsg-1ubuntu0.1~esm1 |
uriparserUbuntu:Pro:24.04:LTS |
before 0.9.7+dfsg-2ubuntu0.1~esm1, plus listed versions 0.9.7+dfsg-20.9.7+dfsg-2build1 |
0.9.7+dfsg-2ubuntu0.1~esm1 |
uriparseropenSUSE:Tumbleweed |
before 0.9.8-1.1 | 0.9.8-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
github.com/uriparser/uriparser/issues/183
openwall.com/lists/oss-security/2024/05/06/1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UG4J7PD475LSCGCSHFU4GMU4TWLDSNW2
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-34403
security-tracker.debian.org/tracker/CVE-2024-34403
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1534
suse.com/support/update/announcement/2024/suse-su-20241860-1
bugzilla.suse.com/1223887
ubuntu.com/security/CVE-2024-34403
cve.org/CVERecord?id=CVE-2024-34403