CVE-2024-28871

2024-04-0415:15:38

CWE-770

GitHub_M

web.nvd.nist.gov

cve-2024-28871

libhtp

http protocol

excessive cpu usage

version 0.5.46

version 0.5.47

patch

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

15.5%

JSON

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available.

Affected configurations

Vulners

Node

oisflibhtp

VendorProductVersionCPE
oisflibhtp*cpe:2.3:a:oisf:libhtp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oisf	libhtp	*	cpe:2.3:a:oisf:libhtp::::::::

CNA Affected

[
  {
    "vendor": "OISF",
    "product": "libhtp",
    "versions": [
      {
        "version": "= 0.5.46",
        "status": "affected"
      }
    ]
  }
]