CVE-2025-67899
Low · 2.9CVSS
2.9
EPSS
0.1%
Published
Dec 14, 2025
CISA due date
—
The record
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | uriparser | 0 | 0.8.5-150000.3.11.1 |
| openSUSE:Leap 15.6 | uriparser | 0 | 0.8.5-150000.3.11.1 |
| openSUSE:Leap 16.0 | uriparser | 0 | 0.9.8-160000.4.1 |
| openSUSE:Tumbleweed | php8 | 0 | 8.5.5-1.1 |
| openSUSE:Tumbleweed | uriparser | 0 | 1.0.0-1.1 |
Related vulnerabilities
- CVE-2026-7263 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may… Also affects php8
- CVE-2026-6104 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name… Also affects php8
- CVE-2026-6735 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.*… Also affects php8
- CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*… Also affects php8
- CVE-2026-7259 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*… Also affects php8
- CVE-2026-7262 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*… Also affects php8
- CVE-2026-7258 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*… Also affects php8
- CVE-2026-7261 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.*… Also affects php8