CVE-2024-23837highCWE-770

CVE-2024-23837: high-severity vulnerability in OISF libhtp

LibHTP unbounded folded header handling leads to denial service

Published · Updated

Follow this CVE+ Monitor libhtp+ Monitor libhtp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.2%
In short

LibHTP, an HTTP parser library, can be overwhelmed by specially crafted HTTP headers that fold (wrap) in unusual ways, causing it to spend excessive time processing them and making the service unavailable to legitimate users.

Technical detail

LibHTP contains an unbounded processing vulnerability in folded header handling (CWE-770) where maliciously crafted HTTP headers with excessive folding can trigger algorithmic complexity attacks. The vulnerability allows remote attackers to cause denial of service through network-based HTTP traffic without authentication, fixed in version 0.5.46.

Summary generated and translated by AI from the official description.
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
OISF · libhtp
Related CVEs — OISF libhtp

In the same product, most dangerous first.

CVE-2024-28871HIGHExcessive CPU used on malformed trafficEPSS 0.8%CVE-2024-45797HIGHLibHTP's unbounded header handling leads to denial serviceEPSS 0.7%CVE-2025-53537HIGHLibHTP's memory leak with lzma can lead to resource starvationEPSS 0.5%