CVE-2024-45797

NameCVE-2024-45797
DescriptionLibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Prior to version 0.5.49, unbounded processing of HTTP request and response headers can lead to excessive CPU time and memory utilization, possibly leading to extreme slowdowns. This issue is addressed in 0.5.49.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4295-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libhtp (PTS)bullseye1:0.5.36-1vulnerable
bullseye (security)1:0.5.36-1+deb11u1fixed
bookworm1:0.5.42-1vulnerable
trixie1:0.5.50-1fixed
forky, sid1:0.5.51-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libhtpsourcebullseye1:0.5.36-1+deb11u1DLA-4295-1
libhtpsource(unstable)1:0.5.49-1

Notes

[bookworm] - libhtp <no-dsa> (Minor issue)
https://github.com/OISF/libhtp/security/advisories/GHSA-rqqp-24ch-248f
https://redmine.openinfosecfoundation.org/issues/7191

Search for package or bug name: Reporting problems