CVE catalog

CVE-2025-71436

raptor2: CVE-2025-71436

Severity: Medium
Published: Oct 20, 2026, 4:16:59 PM UTC
Updated: Oct 25, 2026, 9:00:06 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.50% · Oct 25, 2026

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal() caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 256 bytes or longer to corrupt heap memory, crash applications, and possibly execute code.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	raptor2	sid	`2.0.16-7`	vulnerable
Debian	raptor2	forky	`2.0.16-7`	vulnerable
Debian	raptor2	trixie	`2.0.16-6`	vulnerable
Debian	raptor2	bookworm	`2.0.15-4+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	raptor2	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	raptor2	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	raptor2	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	raptor2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libraptor2-0]Affected
Source package: [raptor2]
Details (2)
- 2.0.15-4+deb12u1 · amd64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
- 2.0.15-4+deb12u1 · arm64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
[libraptor2-dev]Affected
Source package: [raptor2]
Details (2)
- 2.0.15-4+deb12u1 · amd64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
- 2.0.15-4+deb12u1 · arm64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
[libraptor2-doc]Affected
Source package: [raptor2]
Details (2)
- 2.0.15-4+deb12u1 · all · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
- 2.0.15-4+deb12u1 · all · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
[raptor2-utils]Affected
Source package: [raptor2]
Details (2)
- 2.0.15-4+deb12u1 · amd64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm
- 2.0.15-4+deb12u1 · arm64 · bookworm
  Affected
  dsa · raptor2 · debian · bookworm

[Debian 13 (Trixie)]

[libraptor2-0]Affected
Source package: [raptor2]
Details (2)
- 2.0.16-6 · amd64 · trixie
  Affected
  dsa · raptor2 · debian · 13
- 2.0.16-6 · arm64 · trixie
  Affected
  dsa · raptor2 · debian · 13
[libraptor2-dev]Affected
Source package: [raptor2]
Details (2)
- 2.0.16-6 · amd64 · trixie
  Affected
  dsa · raptor2 · debian · 13
- 2.0.16-6 · arm64 · trixie
  Affected
  dsa · raptor2 · debian · 13
[libraptor2-doc]Affected
Source package: [raptor2]
Details (2)
- 2.0.16-6 · all · trixie
  Affected
  dsa · raptor2 · debian · 13
- 2.0.16-6 · all · trixie
  Affected
  dsa · raptor2 · debian · 13
[raptor2-utils]Affected
Source package: [raptor2]
Details (2)
- 2.0.16-6 · amd64 · trixie
  Affected
  dsa · raptor2 · debian · 13
- 2.0.16-6 · arm64 · trixie
  Affected
  dsa · raptor2 · debian · 13

Observed: Oct 25, 2026, 12:22:28 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]