uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3021-1 advisory.

    This update for uriparser fixes the following issues

    - CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a     length in       gigabytes (bsc#1262999).
    - CVE-2026-44927: truncation of `ptrdiff_t` to `int` in various places (bsc#1264578).
    - CVE-2026-44928: function family `EqualsUri` can misclassify two unequal URIs as equal (bsc#1264579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21297-1 advisory.

    This update for uriparser fixes the following issues

    - CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a     length in       gigabytes (bsc#1262999).
    - CVE-2026-44927: truncation of `ptrdiff_t` to `int` in various places (bsc#1264578).
    - CVE-2026-44928: function family `EqualsUri` can misclassify two unequal URIs as equal (bsc#1264579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-aa5877c5ba advisory.

    Update to uriparser-1.0.2.

    ----

    Update to uriparser-1.0.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1733 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

    In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

    In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.31, 8.3.x prior to 8.3.31, 8.4.x prior to 8.4.21, or 8.5.x prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities:

 - Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS(). (CVE-2026-7263)

 - Cross-Site Scripting (XSS) within FPM status endpoint. (CVE-2026-6735)

 - Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259)

 - Out-of-bounds access in mbfl_name2encoding_ex(). (CVE-2026-6104)

 - SQL injection via NUL bytes in quoted strings in PDO_Firebird. (CVE-2025-14179)

 - Stale SOAP_GLOBAL(ref_map) pointer with Apache Map. (CVE-2026-6722)

 - Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261)

 - Broken Apache map value NULL check in SOAP. (CVE-2026-7262)

 - Signed integer overflow of char array offset. (CVE-2026-7568)

 - Inconsistent unsigned char usage with ctype.h functions. (CVE-2026-7258)

 - Numeric truncation in uriparser text range comparison (uriparser before 1.0.1). (CVE-2026-42371)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-593d463bbf advisory.

    Update to uriparser-1.0.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,
    when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across
    requests via session storage. However, in the case SOAP requests results in an error, the persistance is
    handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-
    after-free. This may lead to memory corruption, information disclosure, or process crashes, with
    confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

  - In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded
    NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes
    that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-
    bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected
    functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and
    mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.
    (CVE-2026-6104)

  - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the
    SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without
    incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the
    second entry overwrites the first in the temporary result map, freeing the original PHP object while its
    stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling
    pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with
    control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

  - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to
    improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to
    execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM
    status page. (CVE-2026-6735)

  - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,
    some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the
    systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can
    lead to accessing array with negative offset, which can trigger a denial of service. (CVE-2026-7258)

The version of PHP installed on the remote host is prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.6 advisory.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-57515ed8b1 advisory.

    Update to uriparser-1.0.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327310	SUSE SLES15 Security Update : uriparser (SUSE-SU-2026:3021-1)	Nessus	SuSE Local Security Checks	medium
326685	openSUSE 16 Security Update : uriparser (openSUSE-SU-2026:21297-1)	Nessus	SuSE Local Security Checks	medium
317018	Fedora 43 : uriparser (2026-aa5877c5ba)	Nessus	Fedora Local Security Checks	medium
316984	Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1733)	Nessus	Amazon Linux Local Security Checks	critical
115237	PHP 8.2.x < 8.2.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115236	PHP 8.3.x < 8.3.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115235	PHP 8.4.x < 8.4.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115234	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
314985	Fedora 42 : uriparser (2026-593d463bbf)	Nessus	Fedora Local Security Checks	medium
441480	Alpine: multiple php85 packages: security update to 8.5.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
441480	Alpine: multiple php85 packages: security update to 8.5.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
313112	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Nessus	CGI abuses	critical
312118	Fedora 44 : uriparser (2026-57515ed8b1)	Nessus	Fedora Local Security Checks	medium
310600	Linux Distros Unpatched Vulnerability : CVE-2026-42371	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-42371

medium

Tenable Plugins

medium

medium

medium

critical

critical

critical

critical

critical

medium

critical

critical

critical

medium

medium