debian/libhtp vulnerabilities

Latest debian/libhtp CVEs

Newest publication first

1. DLA-4295-1 libhtp - security update

   Published 2025-09-08

   Unknown

2. CVE-2025-53537 LibHTP's memory leak with lzma can lead to resource starvation

   Published 2025-07-23

   High·CVSS 7.5 EPSS 0.50%

   LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set suricata.yaml app-laye...

3. CVE-2024-45797 LibHTP's unbounded header handling leads to denial service

   Published 2024-10-16

   High·CVSS 7.5 EPSS 0.74%

   LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is...

4. CVE-2024-28871 Excessive CPU used on malformed traffic

   Published 2024-04-04

   High·CVSS 7.5 EPSS 0.84%

   LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available.

5. CVE-2024-23837 LibHTP unbounded folded header handling leads to denial service

   Published 2024-02-26

   High·CVSS 7.5 EPSS 1.2%

   LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.

6. CVE-2019-17420 In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending.

   Published 2019-10-09

   Medium·CVSS 5.3 EPSS 1.4%

   In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending.

7. CVE-2018-10243 htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.

   Published 2019-04-04

   Critical·CVSS 9.8 EPSS 2.3%

   htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest header.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.