CVE-2026-44928: uriparser 1.0.2 fixes CVE-2026-44927 and CVE-2026-44928
Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.7 - Upgrade
Upgrade
alpine/php85to a version that resolves this vulnerability.Fixed in 8.5.12-r0 - Upgrade
Upgrade
alpine/php85to a version that resolves this vulnerability.Fixed in 8.5.7-r0 - Upgrade
Upgrade
alpine/uriparserto a version that resolves this vulnerability.Fixed in 1.0.2-r0 - Upgrade
Upgrade
uriparserto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44928?
CVE-2026-44928 has a medium severity rating due to the potential for misclassification of URIs.
How do I fix CVE-2026-44928?
To fix CVE-2026-44928, upgrade uriparser to version 1.0.2 or later.
What versions of uriparser are affected by CVE-2026-44928?
CVE-2026-44928 affects all versions of uriparser prior to 1.0.2.
What is the impact of CVE-2026-44928 on applications using uriparser?
Applications using affected versions of uriparser may incorrectly treat unequal URIs as equal, leading to potential security issues.
Is CVE-2026-44928 considered a critical vulnerability?
CVE-2026-44928 is not classified as critical, but it still poses a notable risk depending on the application's URI handling.