CVE-2025-71436

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71436
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71436.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-71436
Downstream
Published
2026-10-20T15:40:22Z
Modified
2026-10-21T09:29:36Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
Details

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-122"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71436.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.15"
                        },
                        {
                            "last_affected":  "2.0.16"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.15"
                        },
                        {
                            "last_affected":  "2.0.16"
                        }
                    ],
                    "source":  "CPE_FIELD",
                    "strategy":  "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.15"
                        },
                        {
                            "last_affected":  "2.0.16"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/dajobe/raptor

Affected ranges

Type
GIT
Repo
https://github.com/dajobe/raptor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
361a803a72817ae771db2438277229e6541e1575
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "361a803a72817ae771db2438277229e6541e1575"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
raptor2_1_9_0
raptor2_1_9_1
raptor2_2_0_0
raptor2_2_0_1
raptor2_2_0_11
raptor2_2_0_12
raptor2_2_0_13
raptor2_2_0_14
raptor2_2_0_15
raptor2_2_0_16
raptor2_2_0_2
raptor2_2_0_3
raptor2_2_0_4
raptor2_2_0_5
raptor2_2_0_6
raptor2_2_0_7
raptor2_2_0_9
raptor_1_4_10
raptor_1_4_11
raptor_1_4_12
raptor_1_4_13
raptor_1_4_14
raptor_1_4_15
raptor_1_4_16
raptor_1_4_17
raptor_1_4_18
raptor_1_4_19
raptor_1_4_20
raptor_1_4_9
raptor_last_known_good

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71436.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "28606342760186359071090772176313776565",
            "length":  8499
        },
        "id":  "CVE-2025-71436-10b04d13",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_term.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "66938239581693426383026263222059515443",
                "259584485465945690028212136155334937084",
                "89036700978799506807620125430371984896",
                "328864049422102349596139535530807609223"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-1aa005e6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_grddl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "226315972654761166896024789498319981601",
                "213262695021846885347766168990182579698",
                "190557522686587539688214605721763115444",
                "11048831315800055802070836697162470720",
                "27600186233252947761970196921856087729",
                "267186258393059749557581506783328074113",
                "243794535609392415013595297608796556819",
                "116258337036423597843742434460643206622",
                "226315972654761166896024789498319981601",
                "213262695021846885347766168990182579698",
                "154820100078042321621289261632505071055",
                "301683188472587449640704615398927886226"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-2d0f316a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/turtle_common.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "131342934130210202524423851270591062967",
            "length":  466
        },
        "id":  "CVE-2025-71436-3740ce41",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_term.c",
            "function":  "raptor_new_term_from_literal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "71396101768059219815624262970093655550",
            "length":  3251
        },
        "id":  "CVE-2025-71436-3c4f1e38",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/turtle_common.c",
            "function":  "raptor_stringbuffer_append_turtle_string"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "41830474371742952412953931020267502303",
            "length":  2220
        },
        "id":  "CVE-2025-71436-6109f31c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/turtle_common.c",
            "function":  "raptor_turtle_expand_qname_escapes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "160382519096061996115441676010433134565",
                "98935241406733271375722832655743584830",
                "323881332612992038569604435562296425527",
                "211398533227093335078883857177720704090",
                "267105995082469470503129343285062913789",
                "225875235673922078430577982316326485937",
                "142855113043853070838767096348086060771",
                "80620131699221984490229192213234269833",
                "240750412064361528959433525434782238832",
                "235102079521200471677671275430455608469",
                "323176901484662971978943734638376349757",
                "18399383787807581240807087001518416447",
                "63389406073329194953489326926520384236",
                "238514054251834724940248621986630750455",
                "168404924344692870041581068589290081495",
                "255963726791694855725030491705824423233",
                "315640096078207673645541118536227438383",
                "97616818695423847591645628077657148344",
                "262181626060798840731739145910560411529",
                "296612553560937293268241438109734256195",
                "324715414770207719914018137248441297045",
                "5919471166308677015674699381623978582",
                "249199057687624126473036887327983799581",
                "241994667491241641193872216171858300172",
                "683076190649756398772186859749720657",
                "247261106522257887717461858292501813455",
                "329315847539492724263037109024462964511",
                "119143730906010277435358863299825856332",
                "283696183631096467746053462119694320615",
                "298740977881404963493166613686742570206"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-61b8a92b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_term.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "55494637962888828057509346647836029345",
                "194406096041120371003867391362722967967",
                "277798542588829149758501747849701045566",
                "199173975789224299709710296461194022670",
                "130006057742790266143864186478048918592",
                "142475220496476530838289089869646253925",
                "92231422202147977479932549394435628295",
                "233349939363905123037808123864703153572",
                "126931551804239958802754302052705931537",
                "314605734571310711299507006437612359324",
                "201091878621265424290839022286966782639",
                "338390614316164115773299771966159971026",
                "156667924113136438312751616378604121426",
                "282483323278025408030397830871455901777",
                "200819942141064612101324187235722369288",
                "270254972045785769378720908011939431226",
                "194725759027134821207584890496476045451",
                "201982745840446012718254401153800483134",
                "65086362393360662863042682187061057398",
                "145214448642921781516344694214247934272"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-64338bfc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_stringbuffer.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "257945315265048766419099595891909931604",
            "length":  343
        },
        "id":  "CVE-2025-71436-651a56c8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_www.c",
            "function":  "raptor_www_set_proxy2"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "83142236148807456641322091369486085499",
            "length":  391
        },
        "id":  "CVE-2025-71436-700eefdc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_www.c",
            "function":  "raptor_www_set_user_agent2"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "332968751253747722771171232896531176857",
            "length":  12282
        },
        "id":  "CVE-2025-71436-8baaae92",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_grddl.c",
            "function":  "raptor_grddl_parse_chunk"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "274528366474916169038629089163754026499",
            "length":  8572
        },
        "id":  "CVE-2025-71436-8f2f0385",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_stringbuffer.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "177157611253617610957937871108819335856",
            "length":  443
        },
        "id":  "CVE-2025-71436-a2a7c404",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_stringbuffer.c",
            "function":  "raptor_stringbuffer_copy_to_string"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "59323590455043992079646799892536274486",
            "length":  4441
        },
        "id":  "CVE-2025-71436-b5a879b9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_ntriples.c",
            "function":  "raptor_ntriples_parse_term_internal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "234737823074671903844500460625982620685",
            "length":  1988
        },
        "id":  "CVE-2025-71436-c35d3ce3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_term.c",
            "function":  "raptor_new_term_from_counted_literal"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "273660321438606186608505048061960228570",
                "21958353758987619032171796250053966994",
                "42672993324348679750117780962412472012",
                "126198310958783490811294755664338649679"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-cfc18240",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_parse.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "204719398380319370704264201615657018318",
            "length":  661
        },
        "id":  "CVE-2025-71436-ed6ffa9e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_www.c",
            "function":  "raptor_www_set_http_accept2"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "307536181689350484362653501456268049641",
                "197010037535891906684232235406846915709",
                "1253355910586395386805619162407910989",
                "20422514310580903418120785756037044640",
                "53765001612858786916286695598426280909",
                "17050827043616100255866972497483594349",
                "263168647724175907350204747549406021541",
                "149287794601631881614665606572265931489",
                "297886040194686919126553558498668273194",
                "19259069870342208788174322703086502041",
                "311011784110825810391463658557605271884",
                "328088634591470185037798329938288579059",
                "218751190942700062706387123917712781761",
                "222187353037772200857515270570877537383",
                "142837084005848501799203104875418093640",
                "238524209437126047364954236658763211688",
                "265550619073325233745161776543618795565",
                "243832412437084535110011016312439863347",
                "161774932468599691266228361577826089826",
                "51998606548644822722511180906365092672",
                "73571088599564693695348421960881699067",
                "189529174868176638542167835292557721240",
                "145731254433207287237323310777952468604",
                "285183215117129906841916909981136081142",
                "115112034734195383963064572937417467914",
                "318466888485909121021638654859602351804"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-ee930efa",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_www.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "89301721626692156901866184412445208011",
            "length":  333
        },
        "id":  "CVE-2025-71436-f3841991",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_parse.c",
            "function":  "raptor_parser_get_content"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "210312923262093166973856516530954133085",
                "277964180698608156430628574655854062115",
                "328348257654066056215099670669367375606",
                "232204467462624987517367498193310197490",
                "34439216422250111394011613571328727467",
                "33267662507720084627399765596054772098",
                "140072045546850283129744283296590212063",
                "313964452456080542992739857510537832411"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-71436-f84d31e3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575",
        "target":  {
            "file":  "src/raptor_ntriples.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:29:36Z"