OESA-2026-4757: raptor2 security update
Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fix(es):
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.(CVE-2025-71436)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/raptor2to a version that resolves this vulnerability.Fixed in 2.0.15-22.oe2403sp3
Event History
Frequently Asked Questions
What input must an attacker provide to trigger the issue?
The attacker must cause an application to parse a Turtle, TriG, N-Triples, or N-Quads document containing a language tag that is at least 256 bytes long. No authentication is required, but user interaction is required according to the supplied vector.
Which versions are affected?
Raptor RDF Syntax Library versions 2.0.15 through 2.0.16 are identified as affected.
What is the likely impact on an affected application?
Processing the crafted RDF document can corrupt heap memory and crash the application. The advisory also states that code execution may be possible.