{"id":"CVE-2025-71436","summary":"Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag","details":"Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.","modified":"2026-10-21T09:29:36.960586809Z","published":"2026-10-20T15:40:22.461Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.0.15"},{"last_affected":"2.0.16"}]}]},{"extracted_events":[{"strategy":"CPEApplicability","range":[{"introduced":"2.0.15"},{"last_affected":"2.0.16"}],"source":"CPE_FIELD"}]},{"extracted_events":[{"range":[{"introduced":"2.0.15"},{"last_affected":"2.0.16"}],"source":"DESCRIPTION"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71436.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71436.json"},{"type":"PACKAGE","url":"https://github.com/dajobe/raptor"},{"type":"ARTICLE","url":"https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L200-L218"},{"type":"ARTICLE","url":"https://github.com/dajobe/raptor/blob/raptor2_2_0_16/src/raptor_term.c#L270-L287"},{"type":"FIX","url":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575"},{"type":"REPORT","url":"https://github.com/dajobe/raptor/issues/83"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71436"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/raptor-rdf-syntax-library-2.0.15-through-2.0.16-heap-buffer-overflow-via-language-tag"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dajobe/raptor","events":[{"introduced":"0"},{"fixed":"361a803a72817ae771db2438277229e6541e1575"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"361a803a72817ae771db2438277229e6541e1575"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["raptor2_2_0_16","raptor2_2_0_15","raptor2_2_0_14","raptor2_2_0_13","raptor2_2_0_12","raptor2_2_0_11","raptor2_2_0_9","raptor2_2_0_7","raptor2_2_0_6","raptor2_2_0_5","raptor2_2_0_4","raptor2_2_0_3","raptor2_2_0_2","raptor2_2_0_1","raptor2_2_0_0","raptor2_1_9_1","raptor2_1_9_0","raptor_1_4_20","raptor_1_4_19","raptor_1_4_18","raptor_1_4_17","raptor_1_4_16","raptor_1_4_15","raptor_1_4_14","raptor_1_4_13","raptor_1_4_12","raptor_1_4_11","raptor_1_4_10","raptor_1_4_9","raptor_last_known_good"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71436.json","vanir_signatures":[{"source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_term.c","function":"main"},"deprecated":false,"digest":{"length":8499,"function_hash":"28606342760186359071090772176313776565"},"id":"CVE-2025-71436-10b04d13","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-71436-1aa005e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_grddl.c"},"deprecated":false,"digest":{"line_hashes":["66938239581693426383026263222059515443","259584485465945690028212136155334937084","89036700978799506807620125430371984896","328864049422102349596139535530807609223"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/turtle_common.c"},"deprecated":false,"digest":{"line_hashes":["226315972654761166896024789498319981601","213262695021846885347766168990182579698","190557522686587539688214605721763115444","11048831315800055802070836697162470720","27600186233252947761970196921856087729","267186258393059749557581506783328074113","243794535609392415013595297608796556819","116258337036423597843742434460643206622","226315972654761166896024789498319981601","213262695021846885347766168990182579698","154820100078042321621289261632505071055","301683188472587449640704615398927886226"],"threshold":0.9},"id":"CVE-2025-71436-2d0f316a"},{"digest":{"function_hash":"131342934130210202524423851270591062967","length":466},"id":"CVE-2025-71436-3740ce41","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_term.c","function":"raptor_new_term_from_literal"},"deprecated":false},{"source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/turtle_common.c","function":"raptor_stringbuffer_append_turtle_string"},"deprecated":false,"digest":{"function_hash":"71396101768059219815624262970093655550","length":3251},"id":"CVE-2025-71436-3c4f1e38","signature_type":"Function","signature_version":"v1"},{"target":{"function":"raptor_turtle_expand_qname_escapes","file":"src/turtle_common.c"},"deprecated":false,"digest":{"function_hash":"41830474371742952412953931020267502303","length":2220},"id":"CVE-2025-71436-6109f31c","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575"},{"source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_term.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["160382519096061996115441676010433134565","98935241406733271375722832655743584830","323881332612992038569604435562296425527","211398533227093335078883857177720704090","267105995082469470503129343285062913789","225875235673922078430577982316326485937","142855113043853070838767096348086060771","80620131699221984490229192213234269833","240750412064361528959433525434782238832","235102079521200471677671275430455608469","323176901484662971978943734638376349757","18399383787807581240807087001518416447","63389406073329194953489326926520384236","238514054251834724940248621986630750455","168404924344692870041581068589290081495","255963726791694855725030491705824423233","315640096078207673645541118536227438383","97616818695423847591645628077657148344","262181626060798840731739145910560411529","296612553560937293268241438109734256195","324715414770207719914018137248441297045","5919471166308677015674699381623978582","249199057687624126473036887327983799581","241994667491241641193872216171858300172","683076190649756398772186859749720657","247261106522257887717461858292501813455","329315847539492724263037109024462964511","119143730906010277435358863299825856332","283696183631096467746053462119694320615","298740977881404963493166613686742570206"]},"id":"CVE-2025-71436-61b8a92b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["55494637962888828057509346647836029345","194406096041120371003867391362722967967","277798542588829149758501747849701045566","199173975789224299709710296461194022670","130006057742790266143864186478048918592","142475220496476530838289089869646253925","92231422202147977479932549394435628295","233349939363905123037808123864703153572","126931551804239958802754302052705931537","314605734571310711299507006437612359324","201091878621265424290839022286966782639","338390614316164115773299771966159971026","156667924113136438312751616378604121426","282483323278025408030397830871455901777","200819942141064612101324187235722369288","270254972045785769378720908011939431226","194725759027134821207584890496476045451","201982745840446012718254401153800483134","65086362393360662863042682187061057398","145214448642921781516344694214247934272"]},"id":"CVE-2025-71436-64338bfc","signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_stringbuffer.c"}},{"deprecated":false,"digest":{"length":343,"function_hash":"257945315265048766419099595891909931604"},"id":"CVE-2025-71436-651a56c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"function":"raptor_www_set_proxy2","file":"src/raptor_www.c"}},{"id":"CVE-2025-71436-700eefdc","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_www.c","function":"raptor_www_set_user_agent2"},"deprecated":false,"digest":{"function_hash":"83142236148807456641322091369486085499","length":391}},{"signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_grddl.c","function":"raptor_grddl_parse_chunk"},"deprecated":false,"digest":{"function_hash":"332968751253747722771171232896531176857","length":12282},"id":"CVE-2025-71436-8baaae92","signature_type":"Function"},{"deprecated":false,"digest":{"length":8572,"function_hash":"274528366474916169038629089163754026499"},"id":"CVE-2025-71436-8f2f0385","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"function":"main","file":"src/raptor_stringbuffer.c"}},{"deprecated":false,"digest":{"length":443,"function_hash":"177157611253617610957937871108819335856"},"id":"CVE-2025-71436-a2a7c404","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_stringbuffer.c","function":"raptor_stringbuffer_copy_to_string"}},{"target":{"function":"raptor_ntriples_parse_term_internal","file":"src/raptor_ntriples.c"},"deprecated":false,"digest":{"function_hash":"59323590455043992079646799892536274486","length":4441},"id":"CVE-2025-71436-b5a879b9","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_term.c","function":"raptor_new_term_from_counted_literal"},"deprecated":false,"digest":{"function_hash":"234737823074671903844500460625982620685","length":1988},"id":"CVE-2025-71436-c35d3ce3"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_parse.c"},"deprecated":false,"digest":{"line_hashes":["273660321438606186608505048061960228570","21958353758987619032171796250053966994","42672993324348679750117780962412472012","126198310958783490811294755664338649679"],"threshold":0.9},"id":"CVE-2025-71436-cfc18240"},{"id":"CVE-2025-71436-ed6ffa9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"function":"raptor_www_set_http_accept2","file":"src/raptor_www.c"},"deprecated":false,"digest":{"function_hash":"204719398380319370704264201615657018318","length":661}},{"id":"CVE-2025-71436-ee930efa","signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"file":"src/raptor_www.c"},"deprecated":false,"digest":{"line_hashes":["307536181689350484362653501456268049641","197010037535891906684232235406846915709","1253355910586395386805619162407910989","20422514310580903418120785756037044640","53765001612858786916286695598426280909","17050827043616100255866972497483594349","263168647724175907350204747549406021541","149287794601631881614665606572265931489","297886040194686919126553558498668273194","19259069870342208788174322703086502041","311011784110825810391463658557605271884","328088634591470185037798329938288579059","218751190942700062706387123917712781761","222187353037772200857515270570877537383","142837084005848501799203104875418093640","238524209437126047364954236658763211688","265550619073325233745161776543618795565","243832412437084535110011016312439863347","161774932468599691266228361577826089826","51998606548644822722511180906365092672","73571088599564693695348421960881699067","189529174868176638542167835292557721240","145731254433207287237323310777952468604","285183215117129906841916909981136081142","115112034734195383963064572937417467914","318466888485909121021638654859602351804"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575","target":{"function":"raptor_parser_get_content","file":"src/raptor_parse.c"},"deprecated":false,"digest":{"function_hash":"89301721626692156901866184412445208011","length":333},"id":"CVE-2025-71436-f3841991"},{"target":{"file":"src/raptor_ntriples.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["210312923262093166973856516530954133085","277964180698608156430628574655854062115","328348257654066056215099670669367375606","232204467462624987517367498193310197490","34439216422250111394011613571328727467","33267662507720084627399765596054772098","140072045546850283129744283296590212063","313964452456080542992739857510537832411"]},"id":"CVE-2025-71436-f84d31e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575"}],"vanir_signatures_modified":"2026-10-21T09:29:36Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}