uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containing many commas.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.30, 8.3.x prior to 8.3.29, 8.4.x prior to 8.4.16, or 8.5.x prior to 8.5.1. It is, therefore, affected by multiple vulnerabilities:

 - Information leak of memory in getimagesize. (CVE-2025-14177)

 - Heap buffer overflow in array_merge(). (CVE-2025-14178)

 - PDO quoting result null dereference. (CVE-2025-14180)

 - Unbounded recursion and stack consumption. (CVE-2025-67899) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-bf69e91bda advisory.

    Update to uriparser-1.0.0, fixes CVE-2025-67899.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5c12420f33 advisory.

    Update to uriparser-1.0.0, fixes CVE-2025-67899.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.1 advisory.

  - uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by     ParseMustBeSegmentNzNc with large input containing many commas. (CVE-2025-67899)

  - Debian Linux - php7.4 - None  php8.2 - None  php8.4 - None  Ubuntu Linux - [Unknown description]     (CVE-2025-14177, CVE-2025-14178, CVE-2025-14180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by     ParseMustBeSegmentNzNc with large input containing many commas. (CVE-2025-67899)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
115093	PHP 8.1.x < 8.1.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115091	PHP 8.2.x < 8.2.30 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115090	PHP 8.3.x < 8.3.29 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115089	PHP 8.4.x < 8.4.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
115088	PHP 8.5.x < 8.5.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
279487	Fedora 42 : uriparser (2025-bf69e91bda)	Nessus	Fedora Local Security Checks	low
279449	Fedora 43 : uriparser (2025-5c12420f33)	Nessus	Fedora Local Security Checks	low
279128	PHP 8.5.x < 8.5.1 Multiple Vulnerabilities	Nessus	CGI abuses	low
278650	Linux Distros Unpatched Vulnerability : CVE-2025-67899	Nessus	Misc.	low

Detections

Analytics

CVE-2025-67899

low

Tenable Plugins

high

high

high

high

medium

low

low

low

low