CVE-2026-42371 is a numeric truncation vulnerability in the uriparser library affecting Red Hat Hardened Images RPMs. The issue arises during text range comparison of extremely long URIs (in the gigabyte range), leading to integer overflow or wraparound (CWE-190). A local attacker can exploit this by supplying a malformed, excessively long URI, causing the application to crash or become unavailable due to resource exhaustion or instability. The vulnerability impacts availability but does not affect confidentiality or integrity. The Red Hat advisory provides updated RPM packages including uriparser-1.0.1-1.hum1 versions, but does not explicitly confirm a fix for this CVE in the advisory content. The CVSS base score is not provided by Red Hat, but external sources rate it around 4.7 to 5.1 with high attack complexity and local attack vector.

The vulnerability can cause a denial of service condition by crashing or destabilizing applications that process extremely long URIs using the uriparser library. This results in application unavailability. There is no indication of confidentiality or integrity impact. Exploitation requires local access and high complexity, limiting the attack surface.

The Red Hat advisory includes updated RPM packages for uriparser, but does not explicitly confirm that these updates fix CVE-2026-42371. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, users should limit exposure to processing excessively long URIs and monitor for updates from Red Hat. No vendor-provided mitigations or workarounds are specified in the advisory.