PT-2025-51176 · Uriparser+1 · Uriparser+1

Published 2025-01-01 · Updated 2025-12-26 · CVE-2025-67899

Positive Technologies · (AI Summary)

CVSS v3.1

2.9

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions uriparser versions through 0.9.9

Description The software is susceptible to an issue involving unbounded recursion and stack consumption. This occurs when processing large inputs containing numerous commas, specifically when using the

ParseMustBeSegmentNzNc

function.

Recommendations Update to a newer version of uriparser than 0.9.9. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-67899

ECHO-FAFD-C1A0-0F9D

Affected Products

Debian

Uriparser

References · 15

• https://cve.org/CVERecord?id=CVE-2025-67899 · Security Note
• https://ubuntu.com/security/CVE-2025-67899 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-67899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67899 · Security Note
• https://github.com/uriparser/uriparser/pull/284 · Note
• https://github.com/uriparser/uriparser/issues/282 · Note
• http://openwall.com/lists/oss-security/2025/12/15/1 · Note
• https://twitter.com/Cezar_H_Linux/status/2002691999254900736 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000351453638988024 · Twitter Post
• https://t.me/cveNotify/145871 · Telegram Post
• https://twitter.com/oss_security/status/2004407984068481415 · Twitter Post
• https://t.me/cveNotify/145723 · Telegram Post
• https://twitter.com/CVEnew/status/2000611258006172000 · Twitter Post
• https://t.me/CVEtracker/39785 · Telegram Post
• https://twitter.com/kusanagi_saya/status/2002927787544580195 · Twitter Post