CVE-2018-20721
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex*...
CVE-2018-20721 is a critical vulnerability (CVSS 9.8) in Uriparser Project Uriparser, published January 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in uriparser 0.9.1-1.
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
CVE-2018-20721- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
CVE-2018-20721- Updated
- 2026-11-02
EUVDEUVD-2018-13266 No score
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
EUVD-2018-13266- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vxxw-p73w-mwf4
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex*...
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
GHSA-vxxw-p73w-mwf4- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
CVE-2018-20721- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20721
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
DEBIAN-CVE-2018-20721- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2018-20721
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParseEx functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
- Record
UBUNTU-CVE-2018-20721- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0165-1 No score
Security update for uriparser
This update for uriparser fixes the following issues:
Security issues fixed:
- CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
- CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
- CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
- CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:0165-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0171-1 No score
Security update for uriparser
This update for uriparser fixes the following issues:
Security issues fixed:
- CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
- CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
- CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
- CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).
This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:0171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11488-1 No score
liburiparser1-0.9.5-1.2 on GA media
These are all security issues fixed in the liburiparser1-0.9.5-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11488-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0228-1 No score
Security update for uriparser
This update for uriparser fixes the following issues:
Security issues fixed:
- CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
- CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
- CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
- CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).
- Record
SUSE-SU-2019:0228-1- Updated
- 2026-11-02
OSVUSN-5172-1 No score
uriparser vulnerabilities
It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)
It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)
- Record
USN-5172-1- Updated
- 2026-11-02
OSVUSN-5172-2 No score
uriparser vulnerability
USN-5172-1 fixed vulnerabilities in uriparser. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)
It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)
- Record
USN-5172-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uriparserDebian:12 |
before 0.9.1-1 | 0.9.1-1 |
uriparserDebian:13 |
before 0.9.1-1 | 0.9.1-1 |
uriparserDebian:14 |
before 0.9.1-1 | 0.9.1-1 |
uriparserDebian:8 |
before 0.8.0.1-2+deb8u2, plus listed versions 0.8.0.1-20.8.0.1-2+deb8u1 |
0.8.0.1-2+deb8u2 |
uriparserDebian:9 |
before 0.8.4-1+deb9u2, plus listed versions 0.8.4-10.8.4-1+deb9u1 |
0.8.4-1+deb9u2 |
uriparserUbuntu:Pro:14.04:LTS |
before 0.7.5-1ubuntu2+esm2, plus listed versions 0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm1 |
0.7.5-1ubuntu2+esm2 |
uriparserUbuntu:Pro:16.04:LTS |
before 0.8.4-1ubuntu0.16.04.1~esm2, plus listed versions 0.8.2-10.8.3-10.8.4-1 |
0.8.4-1ubuntu0.16.04.1~esm2 |
uriparserUbuntu:18.04:LTS |
before 0.8.4-1+deb9u2build0.18.04.1, plus listed versions 0.8.4-1 |
0.8.4-1+deb9u2build0.18.04.1 |
uriparseropenSUSE:Leap 15.0 |
before 0.8.5-lp150.2.3.1 | 0.8.5-lp150.2.3.1 |
uriparserSUSE:Package Hub 15 |
before 0.8.5-bp150.2.3.1 | 0.8.5-bp150.2.3.1 |
uriparseropenSUSE:Tumbleweed |
before 0.9.5-1.2 | 0.9.5-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.debian.org/debian-lts-announce/2019/02/msg00028.html
github.com/uriparser/uriparser/commit/cef25028de5ff872c2e1f0a6c562eb3ea9ecbce4
nvd.nist.gov/vuln/detail/CVE-2018-20721
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2018-20721
suse.com/support/update/announcement/2019/suse-su-20190228-1
bugzilla.suse.com/1115722
ubuntu.com/security/CVE-2018-20721
cve.org/CVERecord?id=CVE-2018-20721
lists.opensuse.org/archives/list/[email protected]/thread/DKZ2NZQRNUAKKDGMLSBN4JO4TSGD4AQC