CVE-2025-67899: uriparser 1.0.0 fixes CVE-2025-67899 (DoS, CWE-674)
Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion and stack consumption).
Other sources
uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.1 - Upgrade
Upgrade
uriparserto a version that resolves this vulnerability.Fixed in 1.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67899?
CVE-2025-67899 is considered a high severity vulnerability due to its potential for unbounded recursion and stack consumption.
How do I fix CVE-2025-67899?
To fix CVE-2025-67899, upgrade uriparser to version 0.9.10 or later.
What type of attack does CVE-2025-67899 enable?
CVE-2025-67899 enables denial-of-service attacks through excessive stack consumption.
Which versions of uriparser are affected by CVE-2025-67899?
Versions of uriparser up to and including 0.9.9 are affected by CVE-2025-67899.
What impact does CVE-2025-67899 have on applications?
CVE-2025-67899 can lead to application crashes or increased latency due to stack overflow from large input containing numerous commas.