The Url_init function in utils/url.c in Netembryo 0.0.4 when used by LScube Feng allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via a malformed URI containing a \/:\ sequence as demonstrated by a \DESCRIBE /: RTSP/1.0\ request.