OESA-2026-4758: raptor2 security update
Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fix(es):
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptornewtermfromcountedliteral() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.(CVE-2025-71436)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/raptor2to a version that resolves this vulnerability.Fixed in 2.0.15-22.oe2403sp4
Event History
Frequently Asked Questions
What input must an attacker control to trigger this issue?
An attacker must be able to supply a Turtle, TriG, N-Triples, or N-Quads document that is parsed by the affected Raptor library. The document must contain a language tag that is at least 256 bytes long.
Are unauthenticated attackers able to exploit this vulnerability?
The severity vector indicates no privileges are required and the attack can be performed over the network, but user interaction is required. Exploitation depends on a user or application processing attacker-supplied RDF content.
Which Raptor versions are affected?
Raptor RDF Syntax Library versions from 2.0.15 through 2.0.16 are affected.
What is the likely impact if exploitation succeeds?
A successful exploit can corrupt heap memory and crash the application. Code execution may also be possible.