Skip to content

Commit 284e202

Browse files
authored
uri: Update to uriparser-0.9.9-85-g9a31011 (#20707)
This is specifically to import uriparser/uriparser#284 to fix CVE-2025-67899.
1 parent 03f3da6 commit 284e202

File tree

2 files changed

+117
-121
lines changed

2 files changed

+117
-121
lines changed

NEWS

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,12 @@ PHP NEWS
107107
. Fixed bug GH-20370 (User stream filters could violate typed property
108108
constraints). (alexandre-daubois)
109109

110+
- URI:
111+
. Fixed bug GH-20366 (ext/uri incorrectly throws ValueError when encountering
112+
null byte). (kocsismate)
113+
. Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion
114+
and stack consumption). (Sebastian Pipping)
115+
110116
- XML:
111117
. Fixed bug GH-20439 (xml_set_default_handler() does not properly handle
112118
special characters in attributes when passing data to callback). (ndossche)
@@ -119,10 +125,6 @@ PHP NEWS
119125
. Fix assertion failures resulting in crashes with stream filter
120126
object parameters. (ndossche)
121127

122-
- URI:
123-
. Fixed bug GH-20366 (ext/uri incorrectly throws ValueError when encountering
124-
null byte). (kocsismate)
125-
126128
20 Nov 2025, PHP 8.5.0
127129

128130
- Core:

0 commit comments

Comments
 (0)