uriparser versions prior to 1.0.1 contain a numeric truncation bug in the function that compares the textual range of a URI. When the library receives a URI whose length reaches gigabytes, the numeric comparison can behave unexpectedly, potentially allowing the application to process an oversized URI that it should normally reject. This flaw can lead to a denial of service by forcing the application to handle unusually large input data.

The vulnerability affects all releases of the uriparser library before 1.0.1. Any software that incorporates this library, such as web servers, network utilities, or other applications that parse user‑supplied URIs, may be impacted until it is updated to a fixed version.

The CVSS score of 5.1 indicates a moderate severity. An EPSS score of less than 1 % suggests low exploitation likelihood at present, and the issue is not listed in CISA's KEV catalog. Exploitation would require an attacker to provide an excessively long URI—on the order of gigabytes—to the application. The attack vector is therefore any interface that accepts external URIs and forwards them to uriparser without prior length validation.