{"action":"Upgrade uriparser to 0.9.1-1 or later.","affected":[{"fixed":"0.9.1-1","introduced":"0"}],"component":"uriparser","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.9.1-1"],"id":"tcs_01M5NDBA7BYZA0SA7F36R7CJBH","modified_at":"2026-10-23T18:03:05.206801584Z","published_at":"2019-01-16T14:29:00.247Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2018-20721","https://security-tracker.debian.org/tracker/CVE-2018-20721"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2018-20721#Debian:13/uriparser","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2018-20721"}],"summary":"URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a \"//[:"}