RLSA-2026:94519: Important: raptor2 security update
Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples.
Security Fix(es):
raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling (CVE-2025-71436)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/raptor2to a version that resolves this vulnerability.Fixed in 0:2.0.15-18.el8_10
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using raptor2 to parse RDF/XML or N-Triples are relevant, particularly where the parser processes RDF content that may contain attacker-controlled language tags.
What does an attacker need to exploit the flaw?
The CVSS vector indicates that exploitation can be performed over the network with low complexity and no prior privileges, but requires user interaction. The issue is associated with language tag handling during parsing.
What is the expected security impact?
The advisory identifies arbitrary code execution through a heap-based buffer overflow. Its CVSS vector rates availability impact as high, integrity impact as low, and confidentiality impact as none.