High severity · published Oct 16, 2024
CVE-2024-45797
LibHTP's unbounded header handling leads to denial service
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libhtp · OISF
< 0.5.49 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45797
Exploit
https://github.com/OISF/libhtp/security/advisories/GHSA-rqqp-24ch-248f
Exploit
https://redmine.openinfosecfoundation.org/issues/7191
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/09/msg00009.html
More from libhtp
9.8
CVE-2018-10243
htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header
7.5
CVE-2025-53537
LibHTP's memory leak with lzma can lead to resource starvation
7.5
CVE-2024-28871
Excessive CPU used on malformed traffic
7.5
CVE-2024-23837
LibHTP unbounded folded header handling leads to denial service
7.5
CVE-2015-0928
libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference)