CVE-2024-45797 LibHTP's unbounded header handling leads to denial service

What is CVE-2024-45797?

CVE-2024-45797 is a high-severity denial of service vulnerability in OISF libhtp, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.

Weakness: CWE-770

Which versions are affected by CVE-2024-45797?

It affects 1 product.

Products include Oisf Libhtp.

How do I fix CVE-2024-45797?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-45797 being exploited?

There is no known exploitation of CVE-2024-45797 in the wild and no public exploit code.

Other vulnerabilities in OISF libhtp

• CVE-2018-10243 Memory corruption in n/a Critical 9.8
• CVE-2025-53537 LibHTP's memory leak with lzma can lead to resource starvation High 7.5
• CVE-2024-28871 Excessive CPU used on malformed traffic High 7.5
• CVE-2015-0928 Null dereference in n/a High 7.5
• CVE-2019-17420 Security feature bypass in n/a Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-45797, GHSA-rqqp-24ch-248f, UBUNTU-CVE-2024-45797.