CVE-2024-57823CWE-191

In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path()

Critical · published January 10, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

🔥 A sneaky integer underflow in the Raptor RDF Syntax Library could let attackers manipulate URIs in ways you don't want to imagine! Think of this as a poorly designed elevator that sometimes drops to the basement when it should be stopping at the ground floor — instead of safely normalizing URIs, it risks sending them into the unknown! This vulnerability could allow an attacker to craft malicious URIs that lead to unexpected behaviors, potentially compromising the integrity and security of your application. Imagine your system being tricked into navigating to a dangerous location instead of the safe one you intended — absolutely devastating!

Put simply

Think of this as a poorly designed elevator that sometimes drops to the basement when it should be stopping at the ground floor — instead of safely normalizing URIs, it risks sending them into the unknown! In Raptor RDF Syntax Library versions up to 2.0.16, the turtle parser's normalization process for URIs fails to handle integer underflows properly, leading to unpredictable outcomes when processing certain inputs.

What to do

This vulnerability could allow an attacker to craft malicious URIs that lead to unexpected behaviors, potentially compromising the integrity and security of your application. Imagine your system being tricked into navigating to a dangerous location instead of the safe one you intended — absolutely devastating! Immediate action is required: upgrade to Raptor RDF Syntax Library version 2.0.17 or later to patch this vulnerability. It’s also a good idea to review your URI handling to ensure you're not exposed to similar issues. Don't delay — your application's safety is at stake! You've got this! Fixing this vulnerability will keep your application secure and boost your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2025-01-10T00:00Z
EPSS history
Timeline
  • 10 JAN 00:00Z
    In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path()
    cvelistv5