Every CVE Search/ Get API key

CVE-2024-34402

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an...

8.6 HighFix available

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

1.23%Up 1.2 points since May 3, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2024-34767 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
EUVD-2024-34767
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hwpw-xpj3-c397 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an...

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
GHSA-hwpw-xpj3-c397
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-190
Updated
2026-11-02
NVD 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2024-34402 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
ALPINE-CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-03
OSV 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2024-34402 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
DEBIAN-CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVOESA-2024-1534 5.5

uriparser security update

The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.

Security Fix(es):

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.(CVE-2024-34402)

An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.(CVE-2024-34403)

Record
OESA-2024-1534
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1690 5.5

uriparser security update

The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.

Security Fix(es):

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.(CVE-2024-34402)

Record
OESA-2024-1690
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-34402 8.6

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
UBUNTU-CVE-2024-34402
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVAZL-43227 No score

CVE-2024-34402 affecting package uriparser for versions less than 0.9.8-3

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
AZL-43227
Updated
2026-11-02
OSVAZL-43231 No score

CVE-2024-34402 affecting package uriparser 0.9.7-2

An issue was discovered in uriparser through 0.9.7. ComposeQueryEngine in UriQuery.c has an integer overflow via long keys or values, with a resultant buffer overflow.

Record
AZL-43231
Updated
2026-11-02
OSVopenSUSE-SU-2024:13957-1 No score

liburiparser1-0.9.8-1.1 on GA media

These are all security issues fixed in the liburiparser1-0.9.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13957-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-34402 No score

CVE-2024-34402 in uriparser - Patched by Root

Root has patched CVE-2024-34402 in the uriparser package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2024-34402
Updated
2026-11-02
OSVSUSE-SU-2024:1860-1 No score

Security update for uriparser

This update for uriparser fixes the following issues:

  • CVE-2024-34402: Fixed integer overflow protection in ComposeQueryEngine (bsc#1223887).
  • CVE-2024-34403: Fixed integer overflow protection in ComposeQueryMallocExMm (bsc#1223888).
Record
SUSE-SU-2024:1860-1
Updated
2026-11-02
OSVUSN-7356-1 No score

uriparser vulnerabilities

It was discovered that uriparser did not correctly handle certain inputs, which could lead to an integer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-34402, CVE-2024-34403)

Record
USN-7356-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
uriparser
Alpine:v3.19
 before 0.9.8-r0
0.9.8-r0
uriparser
Alpine:v3.20
 before 0.9.8-r0
0.9.8-r0
uriparser
Alpine:v3.21
 before 0.9.8-r0
0.9.8-r0
uriparser
Alpine:v3.22
 before 0.9.8-r0
0.9.8-r0
uriparser
Alpine:v3.23
 before 0.9.8-r0
0.9.8-r0
uriparser
Alpine:v3.24
 before 0.9.8-r0
0.9.8-r0
uriparser
Azure Linux:3
 before 0.9.8-3
0.9.8-3
uriparser
Azure Linux:2
 through 0.9.7-2 None known
uriparser
Debian:12
 All versions, plus listed versions
0.9.7+dfsg-20.9.8+dfsg-10.9.8+dfsg-21.0.1+dfsg-1
 None known
uriparser
Debian:13
 before 0.9.8+dfsg-1
0.9.8+dfsg-1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
uriparser
Debian:14
 before 0.9.8+dfsg-1
0.9.8+dfsg-1
uriparser
openEuler:20.03-LTS-SP1
 before 0.9.6-2.oe1
0.9.6-2.oe1
uriparser
openEuler:20.03-LTS-SP4
 before 0.9.6-2.oe2003sp4
0.9.6-2.oe2003sp4
uriparser
openEuler:22.03-LTS
 before 0.9.6-2.oe2203sp2
0.9.6-2.oe2203sp2
uriparser
openEuler:22.03-LTS-SP1
 before 0.9.6-2.oe2203sp1
0.9.6-2.oe2203sp1
uriparser
openEuler:22.03-LTS-SP2
 before 0.9.6-2.oe2203sp2
0.9.6-2.oe2203sp2
uriparser
openEuler:22.03-LTS-SP3
 before 0.9.6-2.oe2203sp3
0.9.6-2.oe2203sp3
uriparser
Root:Debian:12
 before 0.9.7+dfsg-2.root.io.2
0.9.7+dfsg-2.root.io.20.9.7+dfsg-2.root.io.10.9.7+dfsg-2.root.io.40.9.7+dfsg-2.root.io.30.9.7+dfsg-2.aikido.5
rootio-uriparser
Root:Debian:12
 before 0.9.7+dfsg-2.root.io.2
0.9.7+dfsg-2.root.io.20.9.7+dfsg-2.root.io.10.9.7+dfsg-2.root.io.40.9.7+dfsg-2.root.io.30.9.7+dfsg-2.aikido.5
uriparser
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 0.8.5-150000.3.8.1
0.8.5-150000.3.8.1
uriparser
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 0.8.5-150000.3.8.1
0.8.5-150000.3.8.1
uriparser
openSUSE:Leap 15.5
 before 0.8.5-150000.3.8.1
0.8.5-150000.3.8.1
uriparser
openSUSE:Leap 15.6
 before 0.8.5-150000.3.8.1
0.8.5-150000.3.8.1
uriparser
Ubuntu:Pro:14.04:LTS
 before 0.7.5-1ubuntu2+esm4, plus listed versions
0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm10.7.5-1ubuntu2+esm20.7.5-1ubuntu2+esm3
0.7.5-1ubuntu2+esm4
uriparser
Ubuntu:Pro:16.04:LTS
 before 0.8.4-1ubuntu0.16.04.1~esm4, plus listed versions
0.8.2-10.8.3-10.8.4-10.8.4-1ubuntu0.16.04.1~esm20.8.4-1ubuntu0.16.04.1~esm3
0.8.4-1ubuntu0.16.04.1~esm4
uriparser
Ubuntu:Pro:18.04:LTS
 before 0.8.4-1+deb9u2ubuntu0.1+esm1, plus listed versions
0.8.4-10.8.4-1ubuntu0.18.04.1~esm20.8.4-1+deb9u2build0.18.04.10.8.4-1+deb9u2ubuntu0.1
0.8.4-1+deb9u2ubuntu0.1+esm1
uriparser
Ubuntu:Pro:20.04:LTS
 before 0.9.3-2ubuntu0.1~esm3, plus listed versions
0.9.3-20.9.3-2ubuntu0.1~esm2
0.9.3-2ubuntu0.1~esm3
uriparser
Ubuntu:Pro:22.04:LTS
 before 0.9.6+dfsg-1ubuntu0.1~esm1, plus listed versions
0.9.4+dfsg-10.9.5+dfsg-20.9.6+dfsg-1
0.9.6+dfsg-1ubuntu0.1~esm1
uriparser
Ubuntu:Pro:24.04:LTS
 before 0.9.7+dfsg-2ubuntu0.1~esm1, plus listed versions
0.9.7+dfsg-20.9.7+dfsg-2build1
0.9.7+dfsg-2ubuntu0.1~esm1
uriparser
openSUSE:Tumbleweed
 before 0.9.8-1.1
0.9.8-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34402 is a high vulnerability (CVSS 8.6) in Uriparser Project Uriparser, published May 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in uriparser 0.9.8-r0.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open