CVE-2025-67899 Denial of service in uriparser
Attackers can cause denial of service via unbounded recursion in the uriparser library by providing large inputs with many commas.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67899?
CVE-2025-67899 is a low-severity denial of service vulnerability in uriparser, published on 14 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
Weakness: CWE-674
Which versions are affected by CVE-2025-67899?
Linux distribution packages (12)
mingw32-uriparser Red Hat:hummingbird:1 | All versions | 0:1.0.0-2.1.hum1 |
mingw64-uriparser Red Hat:hummingbird:1 | All versions | 0:1.0.0-2.1.hum1 |
uriparser Red Hat:hummingbird:1 | All versions | 0:1.0.0-2.1.hum1 |
uriparser-devel Red Hat:hummingbird:1 | All versions | 0:1.0.0-2.1.hum1 |
uriparser-doc Red Hat:hummingbird:1 | All versions | 0:1.0.0-2.1.hum1 |
uriparser SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 0.8.5-150000.3.11.1 |
uriparser SUSE:Linux Enterprise Server 16.0 | All versions | 0.9.8-160000.4.1 |
uriparser SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 0.9.8-160000.4.1 |
uriparser openSUSE:Leap 15.6 | All versions | 0.8.5-150000.3.11.1 |
uriparser openSUSE:Leap 16.0 | All versions | 0.9.8-160000.4.1 |
php8 openSUSE:Tumbleweed | All versions | 8.5.5-1.1 |
uriparser openSUSE:Tumbleweed | All versions | 1.0.0-1.1 |
How do I fix CVE-2025-67899?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-67899 being exploited?
There is no known exploitation of CVE-2025-67899 in the wild and no public exploit code.
Sources
Also known as AZL-72379, AZL-72862, DEBIAN-CVE-2025-67899, ECHO-fafd-c1a0-0f9d, GHSA-h2vr-rqqp-xv8m, RHSA-2026:7642 and 7 more.