CVE-2025-71436: Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Q: Which deployments are exposed?

Deployments using Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are exposed when they parse Turtle, TriG, N-Triples, or N-Quads documents containing language-tagged literals.

Q: What must an attacker provide to trigger the flaw?

An attacker needs to cause the application to parse a supported RDF document with a language tag that is 256 bytes or longer. No authentication or special privileges are indicated by the supplied severity vector, but user interaction is required.

Q: How can I assess whether an application is at immediate risk?

Check whether the application uses Raptor 2.0.15 or 2.0.16 and accepts or processes RDF documents from untrusted sources. Inputs using the affected syntaxes should be reviewed for language tags of 256 bytes or more.

Q: What can be done if updating is not immediately possible?

Reject or sanitize Turtle, TriG, N-Triples, and N-Quads inputs containing language tags of 256 bytes or longer before they reach the vulnerable parser. This specifically removes the documented trigger condition.

Published Oct 20, 2026

Updated

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Affected Software

1 affected component

Raptor RDF Syntax Library>=2.0.15<=2.0.16

Event History

Oct 20, 2026

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are exposed when they parse Turtle, TriG, N-Triples, or N-Quads documents containing language-tagged literals.

What must an attacker provide to trigger the flaw?

An attacker needs to cause the application to parse a supported RDF document with a language tag that is 256 bytes or longer. No authentication or special privileges are indicated by the supplied severity vector, but user interaction is required.

How can I assess whether an application is at immediate risk?

Check whether the application uses Raptor 2.0.15 or 2.0.16 and accepts or processes RDF documents from untrusted sources. Inputs using the affected syntaxes should be reviewed for language tags of 256 bytes or more.

What can be done if updating is not immediately possible?

Reject or sanitize Turtle, TriG, N-Triples, and N-Quads inputs containing language tags of 256 bytes or longer before they reach the vulnerable parser. This specifically removes the documented trigger condition.

CVE-2025-71436: Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the flaw?

How can I assess whether an application is at immediate risk?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker provide to trigger the flaw?

How can I assess whether an application is at immediate risk?

What can be done if updating is not immediately possible?