CVE-2025-67899: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-67899 is an uncontrolled recursion (stack overflow) vulnerability in uriparser, a URI parsing library, affecting all versions through 0.9.9. The flaw was reported on December 6, 2025, publicly disclosed on December 14–15, 2025, and fixed in uriparser 1.0.0 released on December 15, 2025. It carries a CVSS v3.1 base score of 2.9 (Low), reflecting a local attack vector with high complexity and limited availability impact (GitHub Issue, oss-security).

The vulnerability is classified as CWE-674 (Uncontrolled Recursion). The uriparser library's URI parsing functions — including ParseMustBeSegmentNzNc, ParseHexZero, ParseOwnHost2, ParsePort, ParseQueryFrag, ParseSegment, and others — used direct and indirect tail recursion without depth limits. When processing a specially crafted URI string containing a large number of comma-separated segments (e.g., thousands of 1, repetitions), the recursive calls exhaust the call stack, causing a stack overflow and crash. The fix in PR #284 dissolved all 13 identified cases of direct and indirect recursion in UriParse.c, replacing them with iterative constructs using goto-based loops (GitHub Issue, GitHub PR).

Successful exploitation results in a denial of service (DoS) via application crash due to stack exhaustion. The impact is limited to availability — there is no confidentiality or integrity impact. Any application that passes attacker-controlled URI strings to uriparser's parsing functions (e.g., uriParseUriA) is potentially affected, including downstream software such as PHP's uri extension, which bundled the vulnerable library (GitHub PR, oss-security).

No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. A proof-of-concept reproducer was included in the original bug report (a C program passing a long comma-separated string to uriParseUriA), making the trigger trivial to replicate, but exploitation requires local access or the ability to supply input to an application using uriparser (GitHub Issue, Feedly).

1. Identify target: Locate an application that uses uriparser ≤ 0.9.9 and passes user-controlled input to URI parsing functions such as uriParseUriA or uriParseUriW.
2. Craft malicious URI: Construct a string consisting of a very large number of comma-separated values (e.g., thousands of 1, repetitions), which triggers the ParseMustBeSegmentNzNc recursive parsing path.
3. Supply input: Provide the crafted string as a URI argument to the vulnerable application — this may be via a command-line argument, network request, file input, or any other interface that feeds data into uriparser.
4. Trigger stack overflow: The parser recursively calls itself for each comma-delimited segment without a depth limit, exhausting the thread's call stack and causing a crash (SIGSEGV or equivalent), resulting in denial of service (GitHub Issue, GitHub PR).

• Process: Application crash (segmentation fault / stack overflow) in a process that uses uriparser, particularly when processing URI input with many comma characters.
• Logs: Crash reports or core dumps referencing ParseMustBeSegmentNzNc, ParseSegment, ParseQueryFrag, or other uriparser internal functions in the stack trace.
• Application logs: Unexpected termination or restart of services that perform URI parsing, correlated with receipt of unusually long URI strings containing repeated comma characters.

Upgrade uriparser to version 1.0.0 or later, which resolves all identified direct and indirect recursion in the parser by converting recursive functions to iterative equivalents. No configuration-based workaround is available for the library itself; however, applications can mitigate risk by validating and limiting the length of URI inputs before passing them to uriparser. Downstream consumers such as PHP should update their bundled uriparser copy — PHP's uri extension was patched on December 15, 2025 to import the fix (oss-security, GitHub PR).

The uriparser maintainer (Sebastian Pipping / hartwork) coordinated the fix and release publicly via oss-security, noting that uriparser 1.0.0 was timed to coincide with CVE assignment. Contributor TimWolla provided detailed code review of the fix and promptly updated PHP's bundled uriparser copy. The fix was also picked up by Linux distributions including Fedora, openSUSE, and Slackware, which issued updated packages shortly after the release (oss-security, GitHub PR).