Every CVE Search/ Get API key

CVE-2018-19199

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a...

9.8 CriticalFix available

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.34%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
CVE-2018-19199
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
CVE-2018-19199
Updated
2026-11-02
EUVDEUVD-2018-10908 No score

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
EUVD-2018-10908
Updated
2026-11-03
GitHub AdvisoriesGHSA-75xm-fm6x-r3wr 9.8

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a...

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
GHSA-75xm-fm6x-r3wr
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 9.8

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
CVE-2018-19199
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19199 9.8

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
DEBIAN-CVE-2018-19199
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2019:2280 7.3

Red Hat Security Advisory: uriparser security update

Record
RHSA-2019:2280
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-19199 9.8

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Record
UBUNTU-CVE-2018-19199
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:0165-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0165-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:0171-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).

This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:0171-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11488-1 No score

liburiparser1-0.9.5-1.2 on GA media

These are all security issues fixed in the liburiparser1-0.9.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11488-1
Updated
2026-11-02
OSVSUSE-SU-2019:0228-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).
Record
SUSE-SU-2019:0228-1
Updated
2026-11-02
OSVUSN-5172-1 No score

uriparser vulnerabilities

It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)

It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)

Record
USN-5172-1
Updated
2026-11-02
OSVUSN-5172-2 No score

uriparser vulnerability

USN-5172-1 fixed vulnerabilities in uriparser. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)

It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)

Record
USN-5172-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
uriparser
Debian:12
 before 0.9.0-1
0.9.0-1
uriparser
Debian:13
 before 0.9.0-1
0.9.0-1
uriparser
Debian:14
 before 0.9.0-1
0.9.0-1
uriparser
Debian:8
From an advisory covering 3 CVEs
 before 0.8.0.1-2+deb8u1, plus listed versions
0.8.0.1-2
0.8.0.1-2+deb8u1
uriparser
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
Show 14 moreShow less
Affected packages
PackageAffectedFixed
uriparser
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 2 CVEs
 before 0:0.7.5-10.el7
0:0.7.5-10.el7
uriparser
Ubuntu:Pro:14.04:LTS
 before 0.7.5-1ubuntu2+esm1, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu2
0.7.5-1ubuntu2+esm1
uriparser
Ubuntu:18.04:LTS
 before 0.8.4-1+deb9u2build0.18.04.1, plus listed versions
0.8.4-1
0.8.4-1+deb9u2build0.18.04.1
uriparser
Ubuntu:18.04:LTS
From an advisory covering 4 CVEs
 before 0.8.4-1+deb9u2build0.18.04.1, plus listed versions
0.8.4-1
0.8.4-1+deb9u2build0.18.04.1
uriparser
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 0.7.5-1ubuntu2+esm2, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm1
0.7.5-1ubuntu2+esm2
uriparser
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 0.8.4-1ubuntu0.16.04.1~esm2, plus listed versions
0.8.2-10.8.3-10.8.4-1
0.8.4-1ubuntu0.16.04.1~esm2
uriparser
openSUSE:Leap 15.0
From an advisory covering 4 CVEs
 before 0.8.5-lp150.2.3.1
0.8.5-lp150.2.3.1
uriparser
SUSE:Package Hub 15
From an advisory covering 4 CVEs
 before 0.8.5-bp150.2.3.1
0.8.5-bp150.2.3.1
uriparser
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.9.5-1.2
0.9.5-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19199 is a critical vulnerability (CVSS 9.8) in Uriparser Project Uriparser, published November 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. Fixed in uriparser 0.9.0-1.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open