uriparser Stack Overflow Vulnerability Due to Unbounded Recursion

A denial-of-service vulnerability has been identified in uriparser versions through 0.9.9. The issue arises from unbounded recursion in the URI parsing function 'ParseMustBeSegmentNzNc', which can lead to stack overflow and application crashes. This vulnerability can be exploited by providing a URI input that contains a large number of commas, causing the parser to enter a recursive loop that exhausts the stack.

Impact

Exploitation of this vulnerability causes a stack overflow, leading to a crash of the application that uses uriparser for URI parsing.

Reproduction

The vulnerability can be reproduced by using uriparser version 0.9.9 and compiling it with Visual Studio 2022. The issue occurs when the parser is fed a URI string with excessive commas, which triggers the unbounded recursion in the 'ParseMustBeSegmentNzNc' function.

Remediation

Users can update to uriparser version 0.9.10, which includes a fix for this vulnerability by addressing the recursion issue in the parser.