CVE-2025-67899
Unbounded Recursion in uriparser 0.9.9 Causes Stack Overflow
Publication date: 2025-12-14
Last updated on: 2025-12-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uriparser | uriparser | 0.9.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in uriparser through version 0.9.9 allows unbounded recursion and stack consumption when parsing large inputs containing many commas, specifically demonstrated by the function ParseMustBeSegmentNzNc.
How can this vulnerability impact me? :
The vulnerability can lead to excessive stack consumption, potentially causing a denial of service due to stack overflow or application crash when processing specially crafted large inputs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the uriparser library with specially crafted URI inputs containing many commas, such as a very long URI string composed of repeated '1,1,1,1,...' segments. A minimal example involves initializing a UriUriA structure and a UriParserStateA state, then attempting to parse the excessively long URI string to see if it triggers a stack overflow and causes the program to crash. Specific commands would depend on the environment but generally involve running a test program that uses uriparser to parse such inputs and monitoring for crashes or stack overflow errors. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating uriparser to version 0.9.9 or later, where the vulnerability has been fixed by refactoring recursive parsing functions into iterative ones to prevent stack overflow. Downstream projects, such as PHP, have also incorporated this patch, so updating dependent software to versions including this fix is recommended. Additionally, applying strong test coverage and fuzz testing against known-good URI parsers can help ensure the fix's effectiveness. [1]