CVE-2025-67899
Fixed in a distro release EPSS <1%CVSS 2.9
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
Products: uriparser_project uriparser
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | uriparser | no fix |
| Debian 13 | uriparser | no fix |
| Debian 14 | uriparser | 1.0.1+dfsg-1 |
| Red Hat hummingbird 1 | mingw32-uriparser | 0:1.0.0-2.1.hum1 |
| Red Hat hummingbird 1 | mingw64-uriparser | 0:1.0.0-2.1.hum1 |
| Red Hat hummingbird 1 | uriparser | 0:1.0.0-2.1.hum1 |
| Red Hat hummingbird 1 | uriparser-devel | 0:1.0.0-2.1.hum1 |
| Red Hat hummingbird 1 | uriparser-doc | 0:1.0.0-2.1.hum1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | uriparser | 0.8.5-150000.3.11.1 |
| SUSE Linux Enterprise Server 16.0 | uriparser | 0.9.8-160000.4.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | uriparser | 0.9.8-160000.4.1 |
| Ubuntu 25.10 | uriparser | no fix |
| Ubuntu 26.04 LTS | uriparser | no fix |
| Ubuntu 26.10 | uriparser | no fix |
| Ubuntu Pro 14.04 LTS | uriparser | 0.7.5-1ubuntu2+esm5 |
| Ubuntu Pro 16.04 LTS | uriparser | 0.8.4-1ubuntu0.16.04.1~esm5 |
| Ubuntu Pro 18.04 LTS | uriparser | 0.8.4-1+deb9u2ubuntu0.1+esm2 |
| Ubuntu Pro 20.04 LTS | uriparser | 0.9.3-2ubuntu0.1~esm4 |
| Ubuntu Pro 22.04 LTS | uriparser | 0.9.6+dfsg-1ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | uriparser | 0.9.7+dfsg-2ubuntu0.1~esm2 |
| openSUSE Leap 15.6 | uriparser | 0.8.5-150000.3.11.1 |
| openSUSE Leap 16.0 | uriparser | 0.9.8-160000.4.1 |
| openSUSE Tumbleweed | php8 | 8.5.5-1.1 |
| openSUSE Tumbleweed | uriparser | 1.0.0-1.1 |