Live › vulnerability › CVE-2025-71436
Go to dashboardRaptor, a C library for parsing RDF data, truncates language tag lengths to an unsigned char, so Turtle, TriG, N-Triples or N-Quads input with language tags of 256 bytes or more corrupts heap memory. An attacker who supplies such a document can crash the parsing application and possibly run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run Raptor 2.0.15 or 2.0.16 to parse RDF documents in Turtle, TriG, N-Triples or N-Quads format are exposed, especially when they accept documents from outside users or other systems. Teams that do not parse RDF with Raptor, or that run only on trusted local data, can skip it.
No product ranges from the sources yet.
raptor2-config --version or the package manager, and look for versions 2.0.15 and 2.0.16.raptor2 or libraptor.2.0.16 once a fixed release is available; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.
This page as .md · .json · in your agent: get_signal("CVE-2025-71436")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.