The uriparser library’s EqualsUri function incorrectly treats distinct URIs as equal. This oversight lets an attacker supply a crafted URI that the function believes matches an authentic one, potentially bypassing security checks that depend on accurate URI comparison. The flaw is classified as CWE‑670, exposing a misimplementation of equality checks that erodes the reliability of URI validation.

The weakness exists in the uriparser library distributed by uriparser:uriparser before version 1.0.2. All operating systems and applications that link against any pre‑1.0.2 release are impacted. Versions 1.0.2 and newer contain the fix.

The CVSS score of 2.9 indicates low severity. No EPSS data or KEV listing suggests that exploitation likelihood is currently low. Based on the description, it is inferred that an attacker could supply a crafted URI to any application that invokes EqualsUri for direct comparison – this could occur through crafted input, redirects, or API calls. With no publicly documented proof‑of‑concept, the practical risk is limited, but untrusted input into the vulnerable function remains a compliance concern.