VDB
CVE-2024-23837
CVE-2024-23837
PUBLISHED
CVSS 7.5 HIGH
LibHTP unbounded folded header handling leads to denial service
Reported by github_m · Published February 26, 2024
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| libhtp | oisf | 0.5.46 |
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| OISF | libhtp | < 0.5.46 |
| fedoraproject | fedora | 38, 39 |
| oisf | libhtp | 0 |
| OISF | libhtp | 0 |
Timeline
- Feb 26, 2024 CVE Published
- Feb 27, 2024 EPSS Score (30 in total, the first dated here)
- Mar 14, 2024 PoC Published
- Oct 4, 2024 Coalition ESS Score (11 in total, the first dated here)
- Jan 17, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2024-23837
vulnetix vdb fixes CVE-2024-23837Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-23837/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m x_refsource_CONFIRM
- https://github.com/OISF/libhtp/commit/20ac301d801cdf01b3f021cca08a22a87f477c4a x_refsource_MISC
- https://redmine.openinfosecfoundation.org/issues/6444 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2025/09/msg00009.html advisory