uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.31, 8.3.x prior to 8.3.31, 8.4.x prior to 8.4.21, or 8.5.x prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities:

 - Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS(). (CVE-2026-7263)

 - Cross-Site Scripting (XSS) within FPM status endpoint. (CVE-2026-6735)

 - Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259)

 - Out-of-bounds access in mbfl_name2encoding_ex(). (CVE-2026-6104)

 - SQL injection via NUL bytes in quoted strings in PDO_Firebird. (CVE-2025-14179)

 - Stale SOAP_GLOBAL(ref_map) pointer with Apache Map. (CVE-2026-6722)

 - Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261)

 - Broken Apache map value NULL check in SOAP. (CVE-2026-7262)

 - Signed integer overflow of char array offset. (CVE-2026-7568)

 - Inconsistent unsigned char usage with ctype.h functions. (CVE-2026-7258)

 - Numeric truncation in uriparser text range comparison (uriparser before 1.0.1). (CVE-2026-42371)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-593d463bbf advisory.

    Update to uriparser-1.0.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.6 advisory.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-57515ed8b1 advisory.

    Update to uriparser-1.0.1.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
115237	PHP 8.2.x < 8.2.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115236	PHP 8.3.x < 8.3.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115235	PHP 8.4.x < 8.4.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115234	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
314985	Fedora 42 : uriparser (2026-593d463bbf)	Nessus	Fedora Local Security Checks	medium
313112	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Nessus	CGI abuses	critical
312118	Fedora 44 : uriparser (2026-57515ed8b1)	Nessus	Fedora Local Security Checks	medium
310600	Linux Distros Unpatched Vulnerability : CVE-2026-42371	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-42371

medium

Tenable Plugins

critical

critical

critical

critical

medium

critical

medium

medium