CVE-2025-53537

LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled to false. This issue is fixed in version 0.5.51.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53537.json"
}

References

Affected packages

Git / github.com/oisf/libhtp

Affected ranges

Type: GIT
Repo: https://github.com/oisf/libhtp
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

3ff79ead4d6b995b771d392d7f0697bfc9201d5d

Affected versions

0.*

0.2.5

0.5.0

0.5.1

0.5.10

0.5.11

0.5.12

0.5.13

0.5.14

0.5.15

0.5.16

0.5.17

0.5.18

0.5.19

0.5.2

0.5.20

0.5.21

0.5.22

0.5.23

0.5.24

0.5.25

0.5.26

0.5.27

0.5.28

0.5.29

0.5.3

0.5.30

0.5.31

0.5.32

0.5.33

0.5.34

0.5.35

0.5.36

0.5.37

0.5.38

0.5.39

0.5.4

0.5.40

0.5.41

0.5.42

0.5.43

0.5.44

0.5.45

0.5.46

0.5.47

0.5.48

0.5.49

0.5.5

0.5.50

0.5.6

0.5.7

0.5.8

0.5.9