In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. (CVE-2026-44928)

In uriparser versions prior to 1.0.2, the EqualsUri function family has a defect that may cause it to misclassify two unequal URIs as equal. This can result in logic errors in software that depends on this library for URI comparison. The issue is identified as CVE-2026-44928 and has a CVSS 3.1 base score of 5.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity without affecting confidentiality or availability.

The vulnerability may cause applications using uriparser to incorrectly treat distinct URIs as equivalent, potentially leading to logic errors or incorrect behavior in URI-based decision processes. There is no direct impact on confidentiality or availability, and no known exploits are reported in the wild.

A fix is available in uriparser version 1.0.2. Users should upgrade to version 1.0.2 or later to resolve this issue. No vendor advisory content was provided, so verify patch availability from the official uriparser project or distribution maintainers.