CVE-2024-45797

What it actually does

Unbounded processing of HTTP request and response headers leads to excessive CPU time and memory utilization in the LibHTP parser.

Why it matters to the business

Applications relying on LibHTP may experience extreme slowdowns or denial of service, disrupting availability of services that process HTTP traffic.

How an attack unfolds

An attacker crafts HTTP requests or responses containing an excessive number of headers or oversized header content and sends them to a target using a vulnerable version of LibHTP, forcing the parser to consume disproportionate resources until the system slows or becomes unresponsive.

How to fix it

Upgrade oisf/libhtp to version 0.5.49 or apply the commit b28eadc5fa6c51fec6079b106824a11b461fc4ee. Rebuild and redeploy any dependent applications after the update.

How to confirm the fix worked

Confirm the installed LibHTP version is 0.5.49 or later by inspecting build metadata or package manifests; test by sending requests with large header sets and verifying resource usage remains bounded.

Typical attack path

1. Identify services or applications that embed the vulnerable LibHTP library for HTTP parsing
2. Craft malicious HTTP requests or responses with a large volume of headers
3. Transmit the crafted traffic to the target endpoint
4. Observe resource exhaustion leading to slowdown or service disruption

How to detect it

Review application and system logs for spikes in CPU or memory during HTTP header parsing; correlate with inbound traffic patterns showing unusually large or numerous headers.

What your security team should do

• Prioritize upgrade of all LibHTP instances to the fixed commit or 0.5.49
• Implement input size limits or rate limiting on HTTP headers at upstream proxies where feasible
• Monitor CPU and memory metrics for HTTP parsing processes for anomalous spikes