Approved changes feed: RSS · Atom

cpe:2.3:a:oisf:libhtp:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOisf (cd5e037f-1562-515c-af4f-7fdde1a9512b)
ProductLibhtp (f9d0a91e-dddf-5827-ac9e-e5a0b394096d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/libhtp purl2cpe 2026-06-01 10:17:52.079956
pkg:deb/ubuntu/libhtp purl2cpe 2026-06-01 10:17:52.079959
pkg:github/oisf/libhtp purl2cpe 2026-06-01 10:17:52.079962
pkg:rpm/opensuse/libhtp purl2cpe 2026-06-01 10:17:52.079965

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-53537 vulnerable 2026-06-08 07:31:14.681358 LibHTP's memory leak with lzma can lead to resource starvation
HIGH (7.5)
LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled` to false. This issue is fixed in version 0.5.51.
Published: 2025-07-23T20:35:30.824Z
Updated: 2025-07-23T20:48:59.864Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45797 vulnerable 2026-06-08 06:48:09.051698 LibHTP's unbounded header handling leads to denial service
HIGH (7.5)
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
Published: 2024-10-16T18:45:08.000Z
Updated: 2025-11-03T18:08:22.690Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-28871 vulnerable 2026-06-08 06:33:27.779568 Excessive CPU used on malformed traffic
HIGH (7.5)
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available.
Published: 2024-04-04T14:46:02.803Z
Updated: 2024-08-26T20:45:59.274Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-23837 vulnerable 2026-06-08 06:29:40.753337 LibHTP unbounded folded header handling leads to denial service
HIGH (7.5)
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
Published: 2024-02-26T16:17:24.372Z
Updated: 2025-11-03T18:08:14.608Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-17420 vulnerable 2026-06-08 05:13:10.485172 Details available
In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending.
Published: 2019-10-09T23:29:04.000Z
Updated: 2024-08-05T01:40:15.367Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.