Hi,

The following vulnerability was published for raptor2 and is still listed
as unfixed for sid in the security tracker, with no Debian bug yet:

CVE-2025-71436[0]:
Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based
buffer overflow. Callers pass the string length rather than the buffer size
(length + 1, including the NUL terminator) to
raptor_stringbuffer_copy_to_string(), so the terminating NUL is written one
byte past the allocation.

Upstream issue:
https://www.google.com/url?q=https://github.com/dajobe/raptor/issues/83&source=gmail&ust=1793764102338000&sa=E
Upstream fix:
https://www.google.com/url?q=https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575&source=gmail&ust=1793764102338000&sa=E

The fix changes the callers in src/raptor_parse.c and src/raptor_grddl.c to
pass buffer_len + 1 / len + 1, tightens the bounds check in
raptor_stringbuffer_copy_to_string() (src/raptor_stringbuffer.c), and fixes
two related issues in src/raptor_ntriples.c (signed char passed to
isxdigit(), wrong pointer in an error message).

I checked the 2.0.16-7 source on
https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793764102338000&sa=E:
src/raptor_parse.c line
1644 still calls raptor_stringbuffer_copy_to_string(rdf_parser->sb, buffer,
len), and none of the patches in debian/patches touch this code (the
existing
patches cover GitHub issue #70 / CVE-2024-57822 and CVE-2024-57823, fixed in
#1067896).

If you fix the bug, please make sure to include the CVE identifier in
your changelog entry.

[0]
https://www.google.com/url?q=https://security-tracker.debian.org/tracker/CVE-2025-71436&source=gmail&ust=1793764102338000&sa=E
https://www.google.com/url?q=https://www.cve.org/CVERecord?id%3DCVE-2025-71436&source=gmail&ust=1793764102338000&sa=E

Thanks!