[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALkpNnQHhjgua8=6iH+L+5hB1AgcLeJTV9Js_9uQ4OJA5Sd+qQ@mail.gmail.com>
Date: Tue, 12 May 2026 13:44:40 -0400
From: Ilia <ilia@...a.ws>
To: Sebastian Pipping <sebastian@...ping.org>
Cc: oss-security@...ts.openwall.com, solar@...nwall.com
Subject: Re: uriparser 1.0.2 fixes CVE-2026-44927 and CVE-2026-44928
>
> > CVE-2026-44927: In uriparser before 1.0.2, there is pointer difference
> > truncation to int in various places.
>
> From my perspective CVE-2026-44927 is a low-severity security issue that
would be hard to exploit in reality since it requires an actual 2gb+ input
to even trigger. For example, in the context of PHP (which uses the lib)
you'd hit the memory limit long before this even triggers. Therefore, this
is "Low" severity from my perspective. Given the input size, it definitely
doesn't have a remote vector.
>
> CVE-2026-44928: In uriparser before 1.0.2, the function family EqualsUri
> can misclassify two unequal URIs as equal.
I'd say this is more nuanced: Low-Medium since this could theoretically be
abused to bypass certain restrictions that rely on URI comparison. It would
really depend on the consumer; in most cases I think something like this:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- AV:N - exploitable via any URI that flows into the consumer; remote
attacker control of the compared string is the common shape.
- AC:L - trivial; PoC is sub-16-byte ASCII (file:/etc/passwd vs
file:etc/passwd).
- PR:N / UI:N - anonymous, no user interaction.
- C:N / I:L / A:N - integrity-only impact at the library layer; equality
returns wrong answer. No direct C or A.
However, it could go higher depending on use-case, for example, C:L when
the consumer uses uriEqualsUriA for cache-key dedup or signature replay
protection, equality bypass can leak data scoped to the wrong key.
In some extreme (unlikely cases) it could even push to C:H/I:H when the
consumer uses uriEqualsUriA to gate access to file: / data: URIs (allowlist
check, sandbox boundary). file:/etc/passwd vs file:etc/passwd resolve to
different files, but compare equally; this suggests an arbitrary-file-read
bypass.
But that's a stretch, and I wouldn't classify it as such, though it has
chaining potential.
Bottom line, I think somewhere in the 3.1 to 5 range seems reasonable.
--
Ilia Alshanetsky
Technologist, CTO, Entrepreneur
E: ilia@...a.ws
T: @iliaa
B: http://ilia.ws
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
