{"id":"CVE-2021-46142","aliases":["ALPINE-CVE-2021-46142","DEBIAN-CVE-2021-46142","DLA-2883-1","DSA-5063-1","EUVD-2021-32842","GHSA-5jh9-cx9r-v7ww","OESA-2022-1505","UBUNTU-CVE-2021-46142","USN-5256-1","USN-5256-2","openSUSE-SU-2024:11727-1"],"status":"published","title":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in...","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01172,"percentile":0.67684,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-01-06T03:48:36Z","modified":"2026-11-03T06:32:42Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"uriparser","fixed_in":["0.9.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"uriparser","fixed_in":["0.9.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"uriparser","fixed_in":["0.9.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"uriparser","fixed_in":["0.9.6+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"uriparser","fixed_in":["0.7.5-1ubuntu2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"uriparser","fixed_in":["0.8.4-1ubuntu0.16.04.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"uriparser","fixed_in":["0.8.4-1+deb9u2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"uriparser","fixed_in":["0.9.3-2ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1+deb9u3"}]}],"versions":["0.8.4-1","0.8.4-1+deb9u1","0.8.4-1+deb9u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1+deb10u1"}]}],"versions":["0.9.1-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4+dfsg-1+deb11u1"}]}],"versions":["0.9.4+dfsg-1"],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5-1ubuntu2+esm3"}]}],"versions":["0.7.5-1","0.7.5-1ubuntu1","0.7.5-1ubuntu2","0.7.5-1ubuntu2+esm1","0.7.5-1ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1ubuntu0.16.04.1~esm3"}]}],"versions":["0.8.2-1","0.8.3-1","0.8.4-1","0.8.4-1ubuntu0.16.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1+deb9u2ubuntu0.1"}]}],"versions":["0.8.4-1","0.8.4-1+deb9u2build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu0.1~esm2"}]}],"versions":["0.9.3-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1+deb9u2ubuntu0.1"}]}],"versions":["0.8.4-1","0.8.4-1+deb9u2build0.18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.5-1ubuntu2+esm3"}]}],"versions":["0.7.5-1","0.7.5-1ubuntu1","0.7.5-1ubuntu2","0.7.5-1ubuntu2+esm1","0.7.5-1ubuntu2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.4-1ubuntu0.16.04.1~esm3"}]}],"versions":["0.8.2-1","0.8.3-1","0.8.4-1","0.8.4-1ubuntu0.16.04.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu0.1~esm2"}]}],"versions":["0.9.3-2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"uriparser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"extra_packages_for_enterprise_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports"},{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"leap"},{"vendor":"uriparser_project","product":"uriparser"}],"references":[{"url":"https://github.com/uriparser/uriparser/pull/124","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/uriparser/uriparser/issues/122","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://blog.hartwork.org/posts/uriparser-096-with-security-fixes-released/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO6T7WA27H7K3WI2AXUAGPWBGK4HM65D/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGIJTDNEMU2V4H3JJBQVKBRHU5GBQKG2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5063","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46142","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MO6T7WA27H7K3WI2AXUAGPWBGK4HM65D/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGIJTDNEMU2V4H3JJBQVKBRHU5GBQKG2/"},{"url":"https://github.com/advisories/GHSA-5jh9-cx9r-v7ww"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-46142","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-46142","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46141","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-46142","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5256-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5256-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46141","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46142","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T03:48:36Z","modified":"2024-08-04T05:02:10.368Z","updated_at":"2026-11-02T14:33:03.320536Z"}],"euvd":[{"id":"EUVD-2021-32842","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T03:48:36Z","modified":"2024-08-04T05:02:10Z","updated_at":"2026-11-03T03:08:24.682864Z"}],"ghsa":[{"id":"GHSA-5jh9-cx9r-v7ww","title":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in...","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-07T00:00:53Z","modified":"2023-02-03T05:04:08Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:53:29.869331Z"}],"nvd":[{"id":"CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T04:15:06.967Z","modified":"2026-06-17T04:14:34.407Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"ALPINE-CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T04:15:06.967Z","modified":"2026-11-03T06:32:42.069575262Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T04:15:06.967Z","modified":"2026-10-20T10:54:13.487240426Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"DEBIAN-CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T04:15:06.967Z","modified":"2026-10-23T18:04:17.630743527Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"OESA-2022-1505","title":"uriparser security update","description":"The package is a strictly RFC 3986 compliant URI parsing library written in C89(\u0026quot;ANSI C\u0026quot;). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.(CVE-2021-46141)\r\n\r\nAn issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.(CVE-2021-46142)","status":"published","published":"2022-01-28T11:04:46Z","modified":"2026-08-18T01:16:19.238241521Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-46142","description":"An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.","status":"published","published":"2022-01-06T04:15:00Z","modified":"2026-04-22T13:03:59.316924Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"DLA-2883-1","title":"uriparser - security update","status":"published","published":"2022-01-17T00:00:00Z","modified":"2026-03-09T01:23:28.555403Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5063-1","title":"uriparser - security update","status":"published","published":"2022-01-26T00:00:00Z","modified":"2026-03-09T02:11:06.548207Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11727-1","title":"liburiparser1-0.9.6-1.1 on GA media","description":"These are all security issues fixed in the liburiparser1-0.9.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:18.492874Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5256-1","title":"uriparser vulnerabilities","description":"It was discovered that uriparser incorrectly handled certain memory operations.\nAn attacker could use this to cause a denial of service.\n(CVE-2021-46141, CVE-2021-46142)\n","status":"published","published":"2022-07-13T07:11:14Z","modified":"2026-04-22T10:20:46.797069Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5256-2","title":"uriparser vulnerabilities","description":"USN-5256-1 fixed several vulnerabilities in uriparser. This update provides\nthe corresponding update for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 20.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that uriparser incorrectly handled certain memory operations.\n An attacker could use this to cause a denial of service.\n (CVE-2021-46141, CVE-2021-46142)\n","status":"published","published":"2022-07-18T11:55:10Z","modified":"2026-06-29T13:49:35.569035059Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}