CVE-2024-45797: oisf libhtp
Vulnerability summary
CVE-2024-45797 is a high (CVSS 7.5) vulnerability in oisf libhtp. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 16-10-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.73% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundLibhtp
Maturity: poc
Exploit Reference (redmine.openinfosecfoundation.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libhtp< 1:0.5.42-1+deb12u1 | < 1:0.5.49-1
Oisf1 product
- libhtp< 0.5.49
Ubuntu1 product
- libhtp< 0.5.15-1ubuntu0.1~esm1 | < 1:0.5.26-1ubuntu0.1~esm1 | < 1:0.5.32-1ubuntu0.1~esm1 | < 1:0.5.39-1ubuntu0.1~esm1 | < 1:0.5.46-1ubuntu2+esm1
3 vendors · 3 products
References
7 links- github.com/OISF/libhtp/security/advisories/GHSA-rqqp-24ch-248fX Refsource CONFIRMREPORTExploitIssue TrackingPatchVendor Advisory
- redmine.openinfosecfoundation.org/issues/7191X Refsource MISCREPORTExploitIssue TrackingPatchVendor Advisory
