CVE-2025-67899: uriparser_project uriparser Uncontrolled Recursion

CVSS: 2.9v3.1LowDeferred

AliasesSUSE-SU-2026:0444-1SUSE-SU-2026:22084-1RHSA-2026:7642+6 more

Published 14-12-2025Last modified 15-12-2025

Vulnerability summary

CVE-2025-67899 is a low (CVSS 2.9) Uncontrolled Recursion vulnerability in uriparser_project uriparser. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3% of scored vulnerabilities.

Overall risk

12/100

0100

Low · default modelHow is this calculated?

CVSS score

2.9/10

010

Low · v3.1 (CVE.org)

EPSS score

0.14%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

14-12-2025
PublishedVulnerability first disclosed.
15-12-2025
Last modifiedVulnerability information updated.

Description

uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.

CVSS metrics

5 scores · 5 sources · 1 version

v3.12.9

EPSS trend

Probability

0.14%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Redhat5 products

mingw32-uriparser< 0:1.0.0-2.1.hum1
mingw64-uriparser< 0:1.0.0-2.1.hum1
uriparser< 0:1.0.0-2.1.hum1
uriparser-devel< 0:1.0.0-2.1.hum1
uriparser-doc< 0:1.0.0-2.1.hum1

Opensuse4 products

php8&distro=openSUSE Tumbleweed< 8.5.5-1.1
uriparser&distro=openSUSE Leap 15.6< 0.8.5-150000.3.11.1
uriparser&distro=openSUSE Leap 16.0< 0.9.8-160000.4.1
uriparser&distro=openSUSE Tumbleweed< 1.0.0-1.1

Suse3 products

uriparser&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 0.8.5-150000.3.11.1
uriparser&distro=SUSE Linux Enterprise Server 16.0< 0.9.8-160000.4.1
uriparser&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 0.9.8-160000.4.1

Debian1 product

uriparserAll versions (No fix recorded) | < 1.0.1+dfsg-1

Ubuntu1 product

uriparser< 0.7.5-1ubuntu2+esm5 | < 0.8.4-1ubuntu0.16.04.1~esm5 | < 0.8.4-1+deb9u2ubuntu0.1+esm2 | < 0.9.3-2ubuntu0.1~esm4 | < 0.9.6+dfsg-1ubuntu0.1~esm2 | < 0.9.7+dfsg-2ubuntu0.1~esm2 | All versions (No fix recorded)

Uriparser_project1 product