PatchTheCVECVE-2026-44928: In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
CVE-2026-44928 is a low-severity flaw (CVSS 2.9) affecting uriparser. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.9 (Low) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 89%) |
| CISA exploited list | No |
| Weakness | CWE-670 |
| Published | 2026-05-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-44928?
uriparser: upgrade to 1.0.2. Exact commands for each OS are on this page.
Is CVE-2026-44928 being exploited?
CVE-2026-44928 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-44928 affect?
CVE-2026-44928 affects uriparser. Severity is low (CVSS 2.9). In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
How urgent is CVE-2026-44928?
Priority 13/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-44927 LOW 2.9 UPGRADE In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
- CVE-2026-42371 MEDIUM 5.1 UPGRADE uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a