OESA-2026-4756: raptor2 security update

Q: Which inputs can trigger the flaw?

An attacker can supply a Turtle, TriG, N-Triples, or N-Quads document containing a language tag that is 256 bytes or longer. Processing that document can corrupt heap memory and crash the application, with possible code execution.

Q: Which Raptor versions are affected?

Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are affected.

Q: Does exploitation require authentication or user interaction?

The supplied vector indicates network reachability, low attack complexity, no privileges required, and user interaction is required. The advisory does not specify what user action is needed.

Published Nov 11, 2026

Updated

Raptor is Redland&apos;s RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fix(es):

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.(CVE-2025-71436)

Affected Software

1 affected componentFixes available

openeuler/raptor2<2.0.15-22.oe2403sp1

2.0.15-22.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/raptor2 to a version that resolves this vulnerability.
Fixed in 2.0.15-22.oe2403sp1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:25 PM

Data Sourced

via OSV·12:25 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-71436

Frequently Asked Questions

Which inputs can trigger the flaw?

An attacker can supply a Turtle, TriG, N-Triples, or N-Quads document containing a language tag that is 256 bytes or longer. Processing that document can corrupt heap memory and crash the application, with possible code execution.

Which Raptor versions are affected?

Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are affected.

Does exploitation require authentication or user interaction?

The supplied vector indicates network reachability, low attack complexity, no privileges required, and user interaction is required. The advisory does not specify what user action is needed.

OESA-2026-4756: raptor2 security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which inputs can trigger the flaw?

Which Raptor versions are affected?

Does exploitation require authentication or user interaction?

Company

Resources

Contact

Frequently Asked Questions

Which inputs can trigger the flaw?

Which Raptor versions are affected?

Does exploitation require authentication or user interaction?