CVE-2024-34402: Uriparser Buffer Overflow Vulnerability

CVE-2024-34402 Overview

CVE-2024-34402 is an integer overflow vulnerability in uriparser, a widely used C library for parsing and handling Uniform Resource Identifiers (URIs). The flaw exists in the ComposeQueryEngine function within UriQuery.c and affects all versions through 0.9.7. Attackers supplying long query keys or values can trigger an integer overflow that leads to a subsequent heap buffer overflow. Because uriparser is bundled in Fedora and embedded in many downstream applications, network-facing services that build URI query strings from untrusted input are exposed. The vulnerability falls under [CWE-190: Integer Overflow or Wraparound].

Critical Impact
Remote attackers can trigger an integer overflow leading to a buffer overflow in ComposeQueryEngine, enabling memory corruption and denial of service against any application linking uriparser through version 0.9.7.

Affected Products

uriparser through version 0.9.7
Fedora 38, 39, and 40 (uriparser packages)
Downstream applications and libraries that link uriparser for URI composition

Discovery Timeline

2024-05-03 - CVE-2024-34402 published to NVD
2024-05-06 - Public discussion on the Openwall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34402

Vulnerability Analysis

The vulnerability resides in ComposeQueryEngine, the routine uriparser uses to serialize a linked list of key/value pairs into a URI query string. The function calculates the required output buffer size by summing the lengths of each key, value, separator, and any percent-encoded expansion. When the cumulative size exceeds the range of the integer type used for the accumulator, the value wraps around to a small number. The caller then allocates a buffer based on this truncated size and proceeds to write the full, untruncated query content. The write operation overflows the allocated heap region, corrupting adjacent memory.

The issue is reachable from any application that passes attacker-controlled keys or values into uriComposeQuery* APIs, including services that re-emit URIs constructed from user-supplied parameters. See the uriparser GitHub issue #183 and the corresponding fix in pull request #185 for upstream details.

Root Cause

The root cause is unchecked integer arithmetic during length calculation in UriQuery.c. The accumulator used to size the destination buffer is not validated against overflow before being passed to the allocator. Once wraparound occurs, the allocation is undersized relative to the data that will be written.

Attack Vector

Exploitation requires the attacker to influence the keys or values passed into uriComposeQuery*. In network-facing services this typically means submitting a request whose URI parameters, headers, or body fields are reflected into a URI composition step. No authentication or user interaction is needed when the affected code path processes external input. The deterministic outcome is heap corruption and process crash; memory layout dependent code execution cannot be ruled out for affected builds without protections such as heap hardening.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-34402

Indicators of Compromise

Unexpected crashes (SIGSEGV, SIGABRT) in processes linking liburiparser.so versions at or below 0.9.7
Heap corruption signatures in core dumps referencing ComposeQueryEngine or UriQuery.c frames
Inbound HTTP requests containing query keys or values exceeding hundreds of megabytes or otherwise abnormally long URI components

Detection Strategies

Inventory all binaries and containers that link uriparser and compare installed versions against the fixed upstream release referenced in PR #185.
Enable AddressSanitizer or heap hardening (MALLOC_CHECK_, glibc tcache protections) on test builds to surface the overflow during fuzzing of uriComposeQuery* entry points.
Apply web application firewall rules to flag and block requests with anomalously long URI query parameter names or values.

Monitoring Recommendations

Forward crash telemetry and core dump metadata from Linux endpoints into a centralized data lake to correlate repeated faults in uriparser-dependent services.
Monitor package management events on Fedora 38, 39, and 40 hosts for installation of the patched uriparser builds announced through the Fedora package-announce list.
Track outbound and inbound HTTP request size distributions for services that re-emit user-supplied URI parameters.

How to Mitigate CVE-2024-34402

Immediate Actions Required

Upgrade uriparser to the version containing the fix merged via pull request #185, which post-dates 0.9.7.
On Fedora 38, 39, and 40, apply the updated uriparser package shipped through the Fedora package-announce advisories.
Rebuild and redeploy any statically linked binaries and container images that bundle uriparser so the fixed object code is in production.

Patch Information

The upstream fix validates the buffer length computation in ComposeQueryEngine to reject inputs that would overflow the accumulator. Vendor advisories and patch details are tracked at the uriparser GitHub issue #183, pull request #185, and the Fedora package-announce advisory. Additional context appears in the Openwall oss-security thread.

Workarounds

Enforce strict length limits on URI query keys and values before passing them to uriComposeQuery*, rejecting inputs whose combined size approaches SIZE_MAX.
Validate and canonicalize untrusted URIs at the application boundary using length-bounded parsers before invoking uriparser composition routines.
Where upgrading is not yet possible, isolate services that perform URI composition behind a reverse proxy that caps request size and parameter length.

bash

# Configuration example: upgrade uriparser on Fedora
sudo dnf clean all
sudo dnf upgrade --refresh uriparser
rpm -q uriparser

# Verify no running processes still map the old shared object
for pid in $(pgrep -a . | awk '{print $1}'); do
  if grep -q 'liburiparser' /proc/$pid/maps 2>/dev/null; then
    echo "PID $pid still maps liburiparser - restart required"
  fi
done