CVE-2026-42371 — uriparser before 1.0.1 has numeric truncation in text range

title: Detect uriparser numeric truncation exploit attempt (CVE-2026-42371)
id: scw-2026-04-27-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-42371 in uriparser. The vulnerability involves numeric truncation in text range comparison when handling URIs. Attackers might exploit this by sending URIs with extremely large lengths, potentially encoded with specific characters like '%%' to trigger the truncation and bypass checks. This rule looks for URIs containing '://' and a query string containing '%%', which is indicative of an attempt to exploit this specific vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42371/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '://'
      cs-uri-query|contains:
          - '%.25'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse