CVE-2025-67899
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by...
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
CVE-2025-67899- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2025-203311
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
EUVD-2025-203311- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h2vr-rqqp-xv8m
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by...
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
GHSA-h2vr-rqqp-xv8m- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
CVE-2025-67899- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
CVE-2025-67899- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-67899
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
DEBIAN-CVE-2025-67899- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 15 moreShow less
OSVOESA-2026-2187
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.(CVE-2025-67899)
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.(CVE-2026-42371)
- Record
OESA-2026-2187- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2188
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.(CVE-2025-67899)
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.(CVE-2026-42371)
- Record
OESA-2026-2188- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2229
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.(CVE-2025-67899)
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.(CVE-2026-42371)
- Record
OESA-2026-2229- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2230
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.(CVE-2025-67899)
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.(CVE-2026-42371)
- Record
OESA-2026-2230- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2231
uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89("ANSI C"). uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party wrappers. uriparser is packaged in major distributions.
Security Fix(es):
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.(CVE-2025-67899)
uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs with a length in gigabytes.(CVE-2026-42371)
- Record
OESA-2026-2231- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7642
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7642- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-67899
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
UBUNTU-CVE-2025-67899- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-72379 No score
CVE-2025-67899 affecting package uriparser 0.9.8-3
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
AZL-72379- Updated
- 2026-11-05
OSVAZL-72862 No score
CVE-2025-67899 affecting package uriparser 0.9.7-2
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
- Record
AZL-72862- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10045-1 No score
liburiparser1-1.0.0-1.1 on GA media
These are all security issues fixed in the liburiparser1-1.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10045-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10595-1 No score
php8-8.5.5-1.1 on GA media
These are all security issues fixed in the php8-8.5.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10595-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20910-1 No score
Security update for uriparser
This update for uriparser fixes the following issue:
- CVE-2025-67899: unbounded recursion and stack consumption (bsc#1255000).
- Record
openSUSE-SU-2026:20910-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0444-1 No score
Security update for uriparser
This update for uriparser fixes the following issues:
- CVE-2025-67899: large input containing many commas can cause unbounded recursion and stack consumption (bsc#1255000).
- Record
SUSE-SU-2026:0444-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22084-1 No score
Security update for uriparser
This update for uriparser fixes the following issue:
- CVE-2025-67899: unbounded recursion and stack consumption (bsc#1255000).
- Record
SUSE-SU-2026:22084-1- Updated
- 2026-11-02
OSVUSN-8409-1 No score
uriparser vulnerability
It was discovered that uriparser incorrectly handled certain URI strings. An attacker could possibly use this issue to cause uriparser to crash, resulting in a denial of service.
- Record
USN-8409-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
uriparserAzure Linux:3 |
through 0.9.8-3 | None known |
uriparserAzure Linux:2 |
through 0.9.7-2 | None known |
uriparserDebian:12 |
All versions, plus listed versions 0.9.7+dfsg-20.9.8+dfsg-10.9.8+dfsg-21.0.1+dfsg-1 |
None known |
uriparserDebian:13 |
All versions, plus listed versions 0.9.8+dfsg-21.0.1+dfsg-1 |
None known |
uriparserDebian:14 |
before 1.0.1+dfsg-1, plus listed versions 0.9.8+dfsg-2 |
1.0.1+dfsg-1 |
uriparseropenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 1.0.1-1.oe2403 | 1.0.1-1.oe2403 |
uriparseropenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.0.1-1.oe2403sp3 | 1.0.1-1.oe2403sp3 |
uriparseropenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.0.1-1.oe2003sp4 | 1.0.1-1.oe2003sp4 |
uriparseropenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.0.1-1.oe2203sp4 | 1.0.1-1.oe2203sp4 |
uriparseropenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.0.1-1.oe2403sp1 | 1.0.1-1.oe2403sp1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mingw32-uriparserRed Hat:hummingbird:1 |
before 0:1.0.0-2.1.hum1 | 0:1.0.0-2.1.hum1 |
mingw64-uriparserRed Hat:hummingbird:1 |
before 0:1.0.0-2.1.hum1 | 0:1.0.0-2.1.hum1 |
uriparserRed Hat:hummingbird:1 |
before 0:1.0.0-2.1.hum1 | 0:1.0.0-2.1.hum1 |
uriparser-develRed Hat:hummingbird:1 |
before 0:1.0.0-2.1.hum1 | 0:1.0.0-2.1.hum1 |
uriparser-docRed Hat:hummingbird:1 |
before 0:1.0.0-2.1.hum1 | 0:1.0.0-2.1.hum1 |
uriparserSUSE:Linux Enterprise Module for Package Hub 15 SP7 |
before 0.8.5-150000.3.11.1 | 0.8.5-150000.3.11.1 |
uriparseropenSUSE:Leap 15.6 |
before 0.8.5-150000.3.11.1 | 0.8.5-150000.3.11.1 |
uriparserSUSE:Linux Enterprise Server 16.0 |
before 0.9.8-160000.4.1 | 0.9.8-160000.4.1 |
uriparserSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 0.9.8-160000.4.1 | 0.9.8-160000.4.1 |
uriparserUbuntu:Pro:14.04:LTS |
before 0.7.5-1ubuntu2+esm5, plus listed versions 0.7.5-10.7.5-1ubuntu10.7.5-1ubuntu20.7.5-1ubuntu2+esm10.7.5-1ubuntu2+esm20.7.5-1ubuntu2+esm30.7.5-1ubuntu2+esm4 |
0.7.5-1ubuntu2+esm5 |
uriparserUbuntu:Pro:16.04:LTS |
before 0.8.4-1ubuntu0.16.04.1~esm5, plus listed versions 0.8.2-10.8.3-10.8.4-10.8.4-1ubuntu0.16.04.1~esm20.8.4-1ubuntu0.16.04.1~esm30.8.4-1ubuntu0.16.04.1~esm4 |
0.8.4-1ubuntu0.16.04.1~esm5 |
uriparserUbuntu:Pro:18.04:LTS |
before 0.8.4-1+deb9u2ubuntu0.1+esm2, plus listed versions 0.8.4-10.8.4-1ubuntu0.18.04.1~esm20.8.4-1+deb9u2build0.18.04.10.8.4-1+deb9u2ubuntu0.10.8.4-1+deb9u2ubuntu0.1+esm1 |
0.8.4-1+deb9u2ubuntu0.1+esm2 |
uriparserUbuntu:Pro:20.04:LTS |
before 0.9.3-2ubuntu0.1~esm4, plus listed versions 0.9.3-20.9.3-2ubuntu0.1~esm20.9.3-2ubuntu0.1~esm3 |
0.9.3-2ubuntu0.1~esm4 |
uriparserUbuntu:Pro:22.04:LTS |
before 0.9.6+dfsg-1ubuntu0.1~esm2, plus listed versions 0.9.4+dfsg-10.9.5+dfsg-20.9.6+dfsg-10.9.6+dfsg-1ubuntu0.1~esm1 |
0.9.6+dfsg-1ubuntu0.1~esm2 |
uriparserUbuntu:Pro:24.04:LTS |
before 0.9.7+dfsg-2ubuntu0.1~esm2, plus listed versions 0.9.7+dfsg-20.9.7+dfsg-2build10.9.7+dfsg-2ubuntu0.1~esm1 |
0.9.7+dfsg-2ubuntu0.1~esm2 |
uriparserUbuntu:25.10 |
All versions, plus listed versions 0.9.8+dfsg-2 |
None known |
uriparserUbuntu:26.10 |
All versions, plus listed versions 0.9.8+dfsg-2build11.0.1+dfsg-1 |
None known |
uriparserUbuntu:26.04:LTS |
All versions, plus listed versions 0.9.8+dfsg-20.9.8+dfsg-2build1 |
None known |
uriparseropenSUSE:Tumbleweed |
before 1.0.0-1.1 | 1.0.0-1.1 |
php8openSUSE:Tumbleweed |
before 8.5.5-1.1 | 8.5.5-1.1 |
uriparseropenSUSE:Leap 16.0 |
before 0.9.8-160000.4.1 | 0.9.8-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-67899 is a low vulnerability (CVSS 2.9) in Uriparser, published December 14, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in uriparser 1.0.1+dfsg-1.
References
github.com/uriparser/uriparser/issues/282
openwall.com/lists/oss-security/2025/12/15/1
nvd.nist.gov/vuln/detail/CVE-2025-67899
Show 20 moreShow less
security-tracker.debian.org/tracker/CVE-2025-67899
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2187
access.redhat.com/errata/RHSA-2026:7642
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7642.json
bugzilla.redhat.com/show_bug.cgi?id=2422120
cve.org/CVERecord?id=CVE-2025-67899
suse.com/support/update/announcement/2026/suse-su-20260444-1
bugzilla.suse.com/1255000
ubuntu.com/security/CVE-2025-67899