CVE-2025-71436

A flaw was found in raptor2. The library improperly handles language tag lengths when parsing RDF (Resource Description Framework) documents, truncating lengths that exceed 255 bytes. A remote attacker can exploit this vulnerability by supplying a specially crafted document with an overly long language tag to trigger a heap-based buffer overflow. This flaw may allow an attacker to execute arbitrary code or crash the application, causing a Denial of Service (DoS).

Red Hat has rated this vulnerability as having an Important security impact. Exploitation requires an application using an affected raptor2 library to process attacker-controlled RDF data. Successful exploitation can terminate the application and may allow code execution with the privileges of that application. Exposure depends on whether the application accepts untrusted RDF input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure on affected systems, prevent applications using raptor2 from processing RDF documents from untrusted sources. Where applicable, temporarily disable automated RDF imports or restrict access to RDF ingestion interfaces to trusted users and data sources. These measures are effective only if they prevent attacker-controlled RDF data from reaching the affected parser.