From 09cacfb6d77fba92553b79550ab9d7be526aac33 Mon Sep 17 00:00:00 2001
From: milad <miladvf2014@gmail.com>
Date: Sat, 9 May 2026 13:38:20 +0330
Subject: [PATCH] fix: complete affected version info for GHSA-gmxg-5w57-j63q

"details": "A numeric truncation error (CWE-197) exists in uriparser versions prior to 1.0.2. The vulnerable code paths incorrectly cast ptrdiff_t (64-bit) to int (32-bit) when calculating buffer sizes, leading to potential integer overflow. This vulnerability was fixed in commit dd98b0f via pull request #304, which introduced size_t throughout the internal API and added overflow validation at the public API boundaries.",
---
 .../GHSA-gmxg-5w57-j63q.json                  | 30 +++++++++++++++++--
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json b/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json
index 4edf1178a4ef4..ca468f47547ba 100644
--- a/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json
+++ b/advisories/unreviewed/2026/05/GHSA-gmxg-5w57-j63q/GHSA-gmxg-5w57-j63q.json
@@ -6,14 +6,38 @@
   "aliases": [
     "CVE-2026-44927"
   ],
-  "details": "In uriparser before 1.0.2, there is pointer difference truncation to int in various places.",
+  "summary": "uriparser: pointer difference truncation to int",
+  "details": "In uriparser before version 1.0.2, there is a vulnerability (CWE-197: Numeric Truncation Error) where pointer difference results (ptrdiff_t) are incorrectly truncated to int in various code paths. This can lead to integer overflow or incorrect memory calculations. The issue is fixed by correctly using size_t and adding overflow checks.\n\n**Patched version:** 1.0.2\n**Fix Pull Request:** https://github.com/uriparser/uriparser/pull/304",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Other",
+        "name": "uriparser"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.0.2"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "<= 1.0.1"
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -33,4 +57,4 @@
     "github_reviewed_at": null,
     "nvd_published_at": "2026-05-08T08:16:43Z"
   }
-}
\ No newline at end of file
+}