OESA-2026-4755: raptor2 security update
Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fix(es):
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.(CVE-2025-71436)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/raptor2to a version that resolves this vulnerability.Fixed in 2.0.15-22.oe2203sp4
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the affected Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are exposed when they parse Turtle, TriG, N-Triples, or N-Quads documents supplied by an attacker.
What does an attacker need to do to exploit it?
An attacker must provide a supported RDF document containing a language tag that is 256 bytes or longer. Processing that document can corrupt heap memory and crash the application; code execution may also be possible.
How can I identify potentially affected systems?
Identify systems running Raptor RDF Syntax Library 2.0.15 or 2.0.16 and determine whether they parse Turtle, TriG, N-Triples, or N-Quads from untrusted sources. Inputs containing language tags of 256 bytes or more are the relevant trigger condition.