CVE-2024-34403 Overview
CVE-2024-34403 is an integer overflow vulnerability in the uriparser library through version 0.9.7. The flaw resides in the ComposeQueryMallocExMm function inside UriQuery.c. When the function processes a sufficiently long query string, an arithmetic operation on the input length overflows, leading to undersized memory allocation and subsequent memory corruption or process termination. The library is widely embedded in software that parses Uniform Resource Identifiers (URIs), including packages shipped in Fedora 38, 39, and 40. The issue is tracked as CWE-190 and was reported through the upstream uriparser project on GitHub.
Critical Impact
A network-reachable attacker who can supply a crafted URI query to an application linked against vulnerable uriparser builds can trigger a denial-of-service condition through memory corruption in the query composition path.
Affected Products
- uriparser through version 0.9.7
- Fedora 38, 39, and 40 (packages linking uriparser)
- Downstream applications embedding vulnerable uriparser builds
Discovery Timeline
- 2024-05-03 - CVE-2024-34403 published to the National Vulnerability Database (NVD)
- 2024-05-06 - Coordinated disclosure posted to the Openwall oss-security list
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34403
Vulnerability Analysis
The vulnerability is an integer overflow in ComposeQueryMallocExMm, the routine responsible for serializing a linked list of query key/value pairs back into a URI query string. The function calculates the required output buffer size by summing the lengths of each key, value, separator, and terminator. When a very long input string is supplied, the size computation overflows the fixed-width integer type used to hold the running total.
The overflowed value is then passed to the memory allocator, which returns a buffer far smaller than the data being written. Subsequent copy operations write past the end of the allocation, producing heap corruption. In practical terms this manifests as an application crash, resulting in denial of service for any long-running process that parses attacker-controlled URIs.
Root Cause
The root cause is missing overflow checks on length arithmetic before allocation. uriparser accumulates cumulative buffer size from user-controlled string lengths without validating that the running sum stays within the representable range of its size variable. The upstream fix in pull request #186 adds explicit bounds checks and returns a failure status when the computed length would overflow.
Attack Vector
Exploitation requires the ability to deliver a crafted URI to an application that invokes uriparser composition APIs on attacker-influenced data. Typical scenarios include web proxies, mail gateways, redirect processors, and command-line utilities that reserialize query components. The attack executes remotely without authentication but requires the target application to reach the vulnerable code path with a very long input, which raises attack complexity. Successful exploitation impacts availability; the vulnerability is not scored for confidentiality or integrity impact.
No public proof-of-concept exploit or Exploit-DB entry has been published for CVE-2024-34403. Additional context is available in GitHub Issue #183.
Detection Methods for CVE-2024-34403
Indicators of Compromise
- Repeated crash signatures or SIGABRT/SIGSEGV faults in processes that link liburiparser
- Application logs showing failures while parsing or reserializing unusually long URI query strings
- Core dumps whose stack traces include ComposeQueryMallocExMm or callers in UriQuery.c
Detection Strategies
- Inventory installed package versions and flag any uriparser build at or below 0.9.7
- Use Software Composition Analysis (SCA) tooling to identify statically linked copies of uriparser inside third-party binaries and containers
- Monitor web application firewall (WAF) and reverse proxy logs for URI query strings exceeding reasonable length thresholds
Monitoring Recommendations
- Alert on abnormal termination of services that process untrusted URIs, correlated with inbound requests containing oversized query strings
- Track Fedora dnf update history to confirm the patched uriparser package is installed on hosts running Fedora 38, 39, or 40
- Ingest crash telemetry from Linux hosts into a centralized data lake to correlate faults across the fleet
How to Mitigate CVE-2024-34403
Immediate Actions Required
- Upgrade uriparser to a release later than 0.9.7 that incorporates the fix from pull request #186
- Apply Fedora updates announced through the Fedora package-announce mailing list for Fedora 38, 39, and 40
- Rebuild and redeploy any internal software that statically links uriparser after updating the dependency
Patch Information
The upstream fix is available in the uriparser GitHub repository. Review Issue #183 and the corresponding Pull Request #186 for the code change. Fedora shipped updated packages tracked in the Fedora package-announce archives.
Workarounds
- Enforce strict length limits on URI query strings at the network edge (WAF, reverse proxy) until patched packages are deployed
- Reject requests where the query component exceeds application-defined maximums before it reaches uriparser
- Isolate services that must process untrusted long URIs behind restart supervisors so a crash does not degrade availability
# Configuration example: verify installed uriparser version on Fedora
rpm -q uriparser
sudo dnf upgrade --refresh uriparser
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
