In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3021-1 advisory.

    This update for uriparser fixes the following issues

    - CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a     length in       gigabytes (bsc#1262999).
    - CVE-2026-44927: truncation of `ptrdiff_t` to `int` in various places (bsc#1264578).
    - CVE-2026-44928: function family `EqualsUri` can misclassify two unequal URIs as equal (bsc#1264579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21297-1 advisory.

    This update for uriparser fixes the following issues

    - CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a     length in       gigabytes (bsc#1262999).
    - CVE-2026-44927: truncation of `ptrdiff_t` to `int` in various places (bsc#1264578).
    - CVE-2026-44928: function family `EqualsUri` can misclassify two unequal URIs as equal (bsc#1264579).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.5.x prior to 8.5.7. It is, therefore, affected by multiple vulnerabilities:

- Pointer difference truncation to int in various places (uriparser before 1.0.2). (CVE-2026-44927)

- The EqualsUri function family can misclassify two unequal URIs as equal (uriparser before 1.0.2). (CVE-2026-44928)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.7. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.7 advisory.

  - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

  - In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1733 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

    In uriparser before 1.0.2, there is pointer difference truncation to int in various places.
    (CVE-2026-44927)

    In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.
    (CVE-2026-44928)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464421	Echo: uriparser: security update to 0.9.8+dfsg-2+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464421	Echo: uriparser: security update to 0.9.8+dfsg-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
327310	SUSE SLES15 Security Update : uriparser (SUSE-SU-2026:3021-1)	Nessus	SuSE Local Security Checks	Local	medium
326685	openSUSE 16 Security Update : uriparser (openSUSE-SU-2026:21297-1)	Nessus	SuSE Local Security Checks	Local	medium
115262	PHP 8.5.x < 8.5.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
318691	PHP 8.5.x < 8.5.7 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
316984	Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1733)	Nessus	Amazon Linux Local Security Checks	Local	critical
313436	Linux Distros Unpatched Vulnerability : CVE-2026-44928	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-44928

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium