Skip to content

Commit 631b364

Browse files
TimWollaedorian
authored andcommitted
uri: Update to uriparser-0.9.9-85-g9a31011 (#20707)
This is specifically to import uriparser/uriparser#284 to fix CVE-2025-67899. (cherry picked from commit 284e202)
1 parent eb617f3 commit 631b364

File tree

2 files changed

+117
-121
lines changed

2 files changed

+117
-121
lines changed

NEWS

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,12 @@ PHP NEWS
7272
via deep structures). (ndossche)
7373
. Fixed bug GH-20584 (Information Leak of Memory). (ndossche)
7474

75+
- URI:
76+
. Fixed bug GH-20366 (ext/uri incorrectly throws ValueError when encountering
77+
null byte). (kocsismate)
78+
. Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion
79+
and stack consumption). (Sebastian Pipping)
80+
7581
- XML:
7682
. Fixed bug GH-20439 (xml_set_default_handler() does not properly handle
7783
special characters in attributes when passing data to callback). (ndossche)
@@ -84,10 +90,6 @@ PHP NEWS
8490
. Fix assertion failures resulting in crashes with stream filter
8591
object parameters. (ndossche)
8692

87-
- URI:
88-
. Fixed bug GH-20366 (ext/uri incorrectly throws ValueError when encountering
89-
null byte). (kocsismate)
90-
9193
20 Nov 2025, PHP 8.5.0
9294

9395
- Core:

0 commit comments

Comments
 (0)