uriparser CVE-2025-67899

Exploitation requires that the consuming application pass attacker-controlled, unvalidated URI input to uriparser's parsing routines (e.g. uriParseUriA/uriParseSingleUri) so that execution reaches the recursive segment parser ParseMustBeSegmentNzNc; the triggering input is a long or crafted URI such as one containing many commas in a path segment. Limiting factors: the flaw yields only a stack-exhaustion crash (availability loss, no confidentiality/integrity impact per CVSS C:N/I:N); it is only reachable if the application does not impose an input-length cap before parsing; NVD rates complexity high (AC:H), implying some tuning of input depth may be needed to exhaust the stack; and because uriparser is a library, reachability and whether the vector is network or local depends entirely on how the embedding application accepts URIs. No authentication is required at the library level (PR:N).

This is a genuinely low-priority issue rather than a hidden critical. The NVD CVSS 3.1 base score is 2.9 (LOW) with vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning no confidentiality or integrity impact and only limited availability impact (a crash). No EPSS score, CISA KEV entry, or public exploit was provided in the input, so there is no signal of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' The one notable tension is the attack vector: NVD assigned AV:L (local), but uriparser is a general-purpose URI-parsing library and in most real deployments the URI string it parses originates from untrusted network input, which would make the practical vector network-reachable - this discrepancy should be verified against how the consuming application exposes the parser. The vendor ChangeLog describes impact as 'denial of service or more,' leaving open a theoretical possibility of memory corruption beyond a crash, but no evidence of code execution is provided and the CWE (CWE-674, uncontrolled recursion) and symptoms point to stack exhaustion / DoS. Net: low real-world risk, patch during normal maintenance; the input's 'Information Disclosure' tag is inconsistent with the actual DoS nature of the flaw.

An attacker submits a specially crafted URI - for example a long segment containing many commas, as demonstrated against ParseMustBeSegmentNzNc - to an application that calls uriparser to parse it. The recursive-descent parser recurses once per input character across its 13 recursion sites, exhausting the thread stack and crashing the host process (denial of service). The researcher demonstrated the triggering condition, but no public weaponized exploit is identified in the provided data.