Every CVE Search/ Get API key

CVE-2018-19200

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on...

7.5 HighFix available

CVE-2018-19200 is a high vulnerability (CVSS 7.5) in Uriparser Project Uriparser, published November 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.32%, the 83rd percentile. Fixed in uriparser 0.9.0-1.

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.32%Up 1.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
CVE-2018-19200
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
CVE-2018-19200
Updated
2026-11-02
EUVDEUVD-2018-10909 No score

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
EUVD-2018-10909
Updated
2026-11-03
GitHub AdvisoriesGHSA-gjmj-x7m9-7jqw 7.5

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on...

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
GHSA-gjmj-x7m9-7jqw
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 7.5

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
CVE-2018-19200
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19200 7.5

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
DEBIAN-CVE-2018-19200
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2018-19200 7.5

An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.

Record
UBUNTU-CVE-2018-19200
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:0165-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0165-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:0171-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).

This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.

Record
openSUSE-SU-2019:0171-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11488-1 No score

liburiparser1-0.9.5-1.2 on GA media

These are all security issues fixed in the liburiparser1-0.9.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11488-1
Updated
2026-11-02
OSVSUSE-SU-2019:0228-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

Security issues fixed:

  • CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address (bsc#1122193).
  • CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115722).
  • CVE-2018-19199: Fixed an integer overflow caused by an unchecked multiplication via the uriComposeQuery* or uriComposeQueryEx* function (bsc#1115723).
  • CVE-2018-19200: Fixed a operation attempted on NULL input via a uriResetUri* function (bsc#1115724).
Record
SUSE-SU-2019:0228-1
Updated
2026-11-02
OSVUSN-5172-1 No score

uriparser vulnerabilities

It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)

It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)

Record
USN-5172-1
Updated
2026-11-02
OSVUSN-5172-2 No score

uriparser vulnerability

USN-5172-1 fixed vulnerabilities in uriparser. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that uriparser mishandled certain input. An attacker could use this vulnerability to cause uriparser to crash or possibly execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)

It was discovered that uriparser incorrectly handled certain URIs. An attacker could use this vulnerability to cause a crash or possibly leak sensitive information. (CVE-2018-20721)

Record
USN-5172-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
uriparser
Debian:12
 before 0.9.0-1
0.9.0-1
uriparser
Debian:13
 before 0.9.0-1
0.9.0-1
uriparser
Debian:14
 before 0.9.0-1
0.9.0-1
uriparser
Debian:8
 before 0.8.0.1-2+deb8u1, plus listed versions
0.8.0.1-2
0.8.0.1-2+deb8u1
uriparser
Ubuntu:Pro:14.04:LTS
 before 0.7.5-1ubuntu2+esm1, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu2
0.7.5-1ubuntu2+esm1
uriparser
Ubuntu:18.04:LTS
 before 0.8.4-1+deb9u2build0.18.04.1, plus listed versions
0.8.4-1
0.8.4-1+deb9u2build0.18.04.1
uriparser
Ubuntu:Pro:14.04:LTS
 before 0.7.5-1ubuntu2+esm2, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm1
0.7.5-1ubuntu2+esm2
uriparser
Ubuntu:Pro:16.04:LTS
 before 0.8.4-1ubuntu0.16.04.1~esm2, plus listed versions
0.8.2-10.8.3-10.8.4-1
0.8.4-1ubuntu0.16.04.1~esm2
uriparser
openSUSE:Leap 15.0
 before 0.8.5-lp150.2.3.1
0.8.5-lp150.2.3.1
uriparser
SUSE:Package Hub 15
 before 0.8.5-bp150.2.3.1
0.8.5-bp150.2.3.1
uriparser
openSUSE:Tumbleweed
 before 0.9.5-1.2
0.9.5-1.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open