CVE-2024-23837
LibHTP unbounded folded header handling leads to denial service
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
LibHTP unbounded folded header handling leads to denial service
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
CVE-2024-23837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2024-21279
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
EUVD-2024-21279- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
CVE-2024-23837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
LibHTP unbounded folded header handling leads to denial service
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
CVE-2024-23837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-23837
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
DEBIAN-CVE-2024-23837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-23837
LibHTP is a security-aware parser for the HTTP protocol. Crafted traffic can cause excessive processing time of HTTP headers, leading to denial of service. This issue is addressed in 0.5.46.
- Record
UBUNTU-CVE-2024-23837- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:0150-1 No score
Security update for libhtp
This update for libhtp fixes the following issues:
- CVE-2024-23837: excessive processing time of HTTP headers can lead to denial of service (boo#1220403)
- Record
openSUSE-SU-2024:0150-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:0150-2 No score
Security update for libhtp
This update for libhtp fixes the following issues:
- CVE-2024-23837: excessive processing time of HTTP headers can lead to denial of service (boo#1220403)
- Record
openSUSE-SU-2024:0150-2- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13706-1 No score
libhtp-devel-0.5.46-1.1 on GA media
These are all security issues fixed in the libhtp-devel-0.5.46-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13706-1- Updated
- 2026-11-02
OSVUSN-7814-1 No score
libhtp vulnerabilities
It was discovered that LibHTP did not correctly handle certain HTTP headers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-23837)
It was discovered that LibHTP did not correctly parse certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-28871)
It was discovered that LibHTP did not correctly parse certain HTTP requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2024-45797)
It was discovered that LibHTP did not correctly handle certain memory operations. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.04. (CVE-2025-53537)
- Record
USN-7814-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libhtpDebian:12 |
before 1:0.5.42-1+deb12u1, plus listed versions 1:0.5.42-1 |
1:0.5.42-1+deb12u1 |
libhtpDebian:13 |
before 1:0.5.46-1 | 1:0.5.46-1 |
libhtpDebian:11 From an advisory covering 2 CVEs |
before 1:0.5.36-1+deb11u1, plus listed versions 1:0.5.36-1 |
1:0.5.36-1+deb11u1 |
libhtpUbuntu:Pro:16.04:LTS |
before 0.5.15-1ubuntu0.1~esm1, plus listed versions 0.5.15-1 |
0.5.15-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:18.04:LTS |
before 1:0.5.26-1ubuntu0.1~esm1, plus listed versions 1:0.5.25-11:0.5.26-1 |
1:0.5.26-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:20.04:LTS |
before 1:0.5.32-1ubuntu0.1~esm1, plus listed versions 1:0.5.30-11:0.5.31-11:0.5.32-1 |
1:0.5.32-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:22.04:LTS |
before 1:0.5.39-1ubuntu0.1~esm1, plus listed versions 1:0.5.36-11:0.5.38-11:0.5.39-1 |
1:0.5.39-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 0.5.15-1ubuntu0.1~esm1, plus listed versions 0.5.15-1 |
0.5.15-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1:0.5.26-1ubuntu0.1~esm1, plus listed versions 1:0.5.25-11:0.5.26-1 |
1:0.5.26-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1:0.5.32-1ubuntu0.1~esm1, plus listed versions 1:0.5.30-11:0.5.31-11:0.5.32-1 |
1:0.5.32-1ubuntu0.1~esm1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libhtpUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 1:0.5.39-1ubuntu0.1~esm1, plus listed versions 1:0.5.36-11:0.5.38-11:0.5.39-1 |
1:0.5.39-1ubuntu0.1~esm1 |
libhtpUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 1:0.5.46-1ubuntu2+esm1, plus listed versions 1:0.5.45-11:0.5.46-1ubuntu11:0.5.46-1ubuntu2 |
1:0.5.46-1ubuntu2+esm1 |
libhtpSUSE:Package Hub 15 SP5 |
before 0.5.42-bp156.3.3.1 | 0.5.42-bp156.3.3.1 |
libhtpSUSE:Package Hub 15 SP6 |
before 0.5.42-bp156.3.3.1 | 0.5.42-bp156.3.3.1 |
libhtpopenSUSE:Leap 15.5 |
before 0.5.42-bp156.3.3.1 | 0.5.42-bp156.3.3.1 |
libhtpopenSUSE:Leap 15.6 |
before 0.5.42-bp156.3.3.1 | 0.5.42-bp156.3.3.1 |
libhtpopenSUSE:Tumbleweed |
before 0.5.46-1.1 | 0.5.46-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-23837 is a high vulnerability (CVSS 7.5) in Oisf Libhtp, published February 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in libhtp 1:0.5.42-1+deb12u1.
References
github.com/OISF/libhtp/security/advisories/GHSA-f9wf-rrjj-qx8m
redmine.openinfosecfoundation.org/issues/6444
lists.fedoraproject.org/archives/list/[email protected]/message/GOCOBFUTIFHOP2PZOH4ENRFXRBHIRKK4
lists.debian.org/debian-lts-announce/2025/09/msg00009.html
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-23837
security-tracker.debian.org/tracker/CVE-2024-23837
ubuntu.com/security/CVE-2024-23837
cve.org/CVERecord?id=CVE-2024-23837
lists.opensuse.org/archives/list/[email protected]/thread/WSV4SW3Q2M5YNZAO7EJJPWIEXOXJCWZH
bugzilla.suse.com/1220403
suse.com/security/cve/CVE-2024-23837