CVE-2026-44928 Overview
CVE-2026-44928 is a logic flaw in the uriparser library, a widely used C library for parsing and manipulating Uniform Resource Identifiers (URIs). The EqualsUri function family can misclassify two unequal URIs as equal. All versions of uriparser prior to 1.0.2 are affected. The weakness maps to [CWE-670] (Always-Incorrect Control Flow Implementation) and affects integrity through incorrect comparison results returned to calling applications.
Critical Impact
Applications relying on uriparser for URI equality checks, such as access control decisions, deduplication, or cache lookups, may treat distinct URIs as identical and behave incorrectly.
Affected Products
- uriparser versions prior to 1.0.2
- Applications statically or dynamically linking vulnerable uriparser builds
- Downstream packages bundling uriparser as a dependency
Discovery Timeline
- 2026-05-08 - CVE-2026-44928 published to the National Vulnerability Database (NVD)
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-44928
Vulnerability Analysis
The uriparser library exposes an EqualsUri function family used by callers to determine whether two parsed UriUri structures represent the same URI. Under the conditions described in the upstream fix, this comparison logic returns true for inputs that are not actually equivalent. The result is an integrity issue: the function answers a question incorrectly, which propagates into the calling application's decisions.
The scope of impact depends entirely on how the consuming application uses the comparison. Equality results frequently feed authorization checks, origin comparisons, cache keying, redirect validation, and policy enforcement. A caller that trusts the comparison may, for example, accept a crafted URI as matching an allow-listed entry.
No confidentiality or availability impact has been reported, and exploitation does not require authentication or user interaction over the network.
Root Cause
The root cause is incorrect control flow inside the URI comparison routines, addressed in upstream pull request #305 and shipped in uriparser1.0.2. The function does not correctly compare every component required to establish URI equivalence, allowing two structurally distinct URIs to be reported as equal. See the uriparser pull request #305 for the corrective patch.
Attack Vector
Exploitation is logical rather than memory-based. An attacker supplies a URI value to an application that compares it against a trusted reference using uriEqualsUriA or related functions. When the comparison returns a false positive, the attacker's URI is treated as the trusted one. The attack vector is network-reachable wherever the application accepts URIs from untrusted sources, such as HTTP headers, redirect targets, or configuration inputs.
No verified public proof-of-concept is available. The vulnerability mechanism is described in the upstream patch rather than reproduced here.
Detection Methods for CVE-2026-44928
Indicators of Compromise
- Application logs showing successful actions on URIs that should not have matched allow-list or policy entries
- Unexpected cache hits or session reuse tied to URIs that differ in components such as scheme, authority, path, or query
- Presence of uriparser shared objects or static archives at versions below 1.0.2 in build manifests or SBOMs
Detection Strategies
- Inventory all binaries and packages that link against uriparser using software composition analysis and SBOM tooling
- Compare deployed library versions against 1.0.2 and flag any earlier release
- Add unit tests around URI equality decisions in calling code to catch false-positive matches
Monitoring Recommendations
- Monitor authorization and redirect-validation logs for anomalies where input URIs differ from expected canonical forms
- Alert on package manager events that install or retain uriparser versions below 1.0.2
- Track upstream advisories from the uriparser project for follow-on fixes
How to Mitigate CVE-2026-44928
Immediate Actions Required
- Upgrade uriparser to version 1.0.2 or later across all systems and container images
- Rebuild and redeploy applications that statically link uriparser after upgrading the dependency
- Audit code paths that depend on uriEqualsUriA results for security-relevant decisions
Patch Information
The fix is delivered in uriparser1.0.2 via uriparser pull request #305. Distribution maintainers are expected to backport the patch to supported branches. Verify the installed version with the package manager or by inspecting uriparser's UriBase.h macros.
Workarounds
- Where upgrading is not immediately possible, perform an additional explicit comparison of URI components (scheme, authority, path, query, fragment) in application code before trusting the EqualsUri result
- Canonicalize URIs to a normalized string form and compare the strings as a secondary check
- Restrict accepted URI inputs to a strict allow-list of literal values where feasible
# Verify installed uriparser version on Debian/Ubuntu
dpkg -l | grep liburiparser
# Verify installed uriparser version on RHEL/Fedora
rpm -q uriparser
# Upgrade to the patched release
# (example for source builds)
git clone https://github.com/uriparser/uriparser.git
cd uriparser
git checkout uriparser-1.0.2
cmake -S . -B build && cmake --build build && sudo cmake --install build
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
