CVE-2025-71436
CVE-2025-71436 · Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.
CVSS 7.1 · High · EPSS 0.5%
- Published
- Updated
Affected products and versions
raptor rdf syntax library
- Versions
- ≥ 2.0.15, ≤ 2.0.16: Affected (semver)
No fix published
Original sources
- https://github.com/dajobe/raptor/issues/83
- https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575
- https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218
- https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287
- https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag
- https://nvd.nist.gov/vuln/detail/CVE-2025-71436