diff --git a/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json b/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json index 4edf1178a4ef4..ca468f47547ba 100644 --- a/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json +++ b/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json @@ -6,14 +6,38 @@ "aliases": [ "CVE-2026-44927" ], - "details": "In uriparser before 1.0.2, there is pointer difference truncation to int in various places.", + "summary": "uriparser: pointer difference truncation to int", + "details": "In uriparser before version 1.0.2, there is a vulnerability (CWE-197: Numeric Truncation Error) where pointer difference results (ptrdiff_t) are incorrectly truncated to int in various code paths. This can lead to integer overflow or incorrect memory calculations. The issue is fixed by correctly using size_t and adding overflow checks.\n\n**Patched version:** 1.0.2\n**Fix Pull Request:** https://github.com/uriparser/uriparser/pull/304", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Other", + "name": "uriparser" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.2" + } + ] + } + ], + "versions": [ + "<= 1.0.1" + ] + } + ], "references": [ { "type": "ADVISORY", @@ -33,4 +57,4 @@ "github_reviewed_at": null, "nvd_published_at": "2026-05-08T08:16:43Z" } -} \ No newline at end of file +}