TI-2024-38091 Aliases CVE-2024-57823 GHSA-4mjp-wj5r-mc96

Integer underflow in librdf Raptor RDF Syntax Library

HIGH 75CWE-191Published 2025-01-10 · Updated 2025-11-03

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-191 and the CVSS impact.

Summary

In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path().

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00346 28th percentileScored 2026-11-07

Public exploit Yes 3 exploit referencesTagged by NVD

Fix Partial Red Hat: 10 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
librdf	Raptor RDF Syntax Library	up to 2.0.16	—	No fix listed	CNA

Raptor RDF Syntax Library Vendorlibrdf Affected up to 2.0.16 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:librdf:raptor_rdf_syntax_library::::::::	up to 2.0.16	Vulnerable	librdf

cpe:2.3:a:librdf:raptor_rdf_syntax_library:*:*:*:*:*:*:*:* Versions up to 2.0.16 Vulnerable ·librdf

Remediation

Red Hat 10 advisories

RHSA-2025:0326 Released 2025-01-15 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) raptor2-2.0.15-17.el8_6
- Red Hat Enterprise Linux AppStream E4S (v.8.6) raptor2-2.0.15-17.el8_6
- Red Hat Enterprise Linux AppStream TUS (v.8.6) raptor2-2.0.15-17.el8_6
RHSA-2025:0318 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat CodeReady Linux Builder EUS (v.8.8) raptor2-devel-2.0.15-17.el8_8
- Red Hat Enterprise Linux AppStream EUS (v.8.8) raptor2-2.0.15-17.el8_8
RHSA-2025:0319 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) raptor2-2.0.9-5.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) raptor2-2.0.9-5.el7_9, raptor2-2.0.9-5.el7_9.ppc, raptor2-devel-2.0.9-5.el7_9 +1

Show 7 more Red Hat advisories

RHSA-2025:0314 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux AppStream (v. 8) raptor2-2.0.15-17.el8_10
- Red Hat Enterprise Linux CRB (v. 8) raptor2-devel-2.0.15-17.el8_10
RHSA-2025:0316 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat CodeReady Linux Builder EUS (v.9.4) raptor2-devel-2.0.15-31.el9_4
- Red Hat Enterprise Linux AppStream EUS (v.9.4) raptor2-2.0.15-31.el9_4
RHSA-2025:0312 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat CodeReady Linux Builder (v. 9) raptor2-devel-2.0.15-32.el9_5
- Red Hat Enterprise Linux AppStream (v. 9) raptor2-2.0.15-32.el9_5
RHSA-2025:0313 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) raptor2-2.0.15-17.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) raptor2-2.0.15-17.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) raptor2-2.0.15-17.el8_4
RHSA-2025:0315 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) raptor2-2.0.15-17.el8_2
RHSA-2025:0310 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat CodeReady Linux Builder EUS (v.9.2) raptor2-devel-2.0.15-31.el9_2
- Red Hat Enterprise Linux AppStream EUS (v.9.2) raptor2-2.0.15-31.el9_2
RHSA-2025:0311 Released 2025-01-14 · Red Hat rating Important
raptor2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) raptor2-2.0.15-31.el9_0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 9)	Fixed	RHSA-2025:0312
Red Hat CodeReady Linux Builder EUS (v.8.8)	Fixed	RHSA-2025:0318
Red Hat CodeReady Linux Builder EUS (v.9.2)	Fixed	RHSA-2025:0310
Red Hat CodeReady Linux Builder EUS (v.9.4)	Fixed	RHSA-2025:0316
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2025:0314
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2025:0312
Red Hat Enterprise Linux AppStream AUS (v. 8.2)	Fixed	RHSA-2025:0315
Red Hat Enterprise Linux AppStream AUS (v.8.4)	Fixed	RHSA-2025:0313
Red Hat Enterprise Linux AppStream AUS (v.8.6)	Fixed	RHSA-2025:0326
Red Hat Enterprise Linux AppStream E4S (v.8.4)	Fixed	RHSA-2025:0313
Red Hat Enterprise Linux AppStream E4S (v.8.6)	Fixed	RHSA-2025:0326
Red Hat Enterprise Linux AppStream E4S (v.9.0)	Fixed	RHSA-2025:0311
Red Hat Enterprise Linux AppStream EUS (v.8.8)	Fixed	RHSA-2025:0318
Red Hat Enterprise Linux AppStream EUS (v.9.2)	Fixed	RHSA-2025:0310
Red Hat Enterprise Linux AppStream EUS (v.9.4)	Fixed	RHSA-2025:0316
Red Hat Enterprise Linux AppStream TUS (v.8.4)	Fixed	RHSA-2025:0313
Red Hat Enterprise Linux AppStream TUS (v.8.6)	Fixed	RHSA-2025:0326
Red Hat Enterprise Linux CRB (v. 8)	Fixed	RHSA-2025:0314
Red Hat Enterprise Linux Server (v. 7 ELS)	Fixed	RHSA-2025:0319
Red Hat Enterprise Linux Server Optional (v. 7 ELS)	Fixed	RHSA-2025:0319

Timeline

2026-10-02 Threatist record created from CVE-2024-57823
2026-10-03 Alias added: GHSA-4mjp-wj5r-mc96

References

Exploit 3

TI-2024-38090 Out-of-bounds read in librdf Raptor RDF Syntax Library CVSS 3.1MEDIUM 5.5
TI-2017-14074 raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax… CVSS 3.1HIGH 7.1
TI-2020-15728 Improper input validation in raptor2 CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences