CVE-2024-45797 Overview
CVE-2024-45797 is a resource exhaustion vulnerability in LibHTP, a security-aware parser for the Hypertext Transfer Protocol (HTTP) maintained by the Open Information Security Foundation (OISF). The library processes HTTP request and response headers without applying upper bounds on header count or size. An attacker who can send crafted HTTP traffic to a system using LibHTP can cause excessive CPU and memory consumption. The condition results in extreme slowdowns and possible denial of service against network security tools that depend on LibHTP, including Suricata-based intrusion detection deployments. The issue is fixed in LibHTP version 0.5.49.
Critical Impact
Remote, unauthenticated attackers can trigger high CPU and memory usage in LibHTP-based inspection engines, degrading availability of network security monitoring.
Affected Products
- OISF LibHTP versions prior to 0.5.49
- Suricata deployments and other network inspection tools that embed vulnerable LibHTP releases
- Debian LTS packages bundling affected LibHTP versions
Discovery Timeline
- 2024-10-16 - CVE-2024-45797 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45797
Vulnerability Analysis
The vulnerability is classified under [CWE-770] Allocation of Resources Without Limits or Throttling. LibHTP parses HTTP request and response headers as it reconstructs application layer traffic for inspection. The parser accepts an unbounded number of headers and does not cap cumulative header data. An attacker who repeatedly sends HTTP messages containing large volumes of header fields forces the library into extended parsing loops. Each additional header adds parsing work and allocated storage. Under sustained attack, CPU utilization rises sharply and memory grows until the host slows or fails to keep up with live traffic. Systems that rely on LibHTP for inline inspection lose visibility into concurrent flows during the condition.
Root Cause
The root cause is missing enforcement of quantitative limits during header parsing. LibHTP versions prior to 0.5.49 do not reject or truncate HTTP messages that carry an abnormally large number of headers or oversized header collections. Bounded processing was added in the 0.5.49 release to constrain both header count and cumulative header size.
Attack Vector
Exploitation requires only network access to a target that inspects HTTP traffic with LibHTP. No authentication or user interaction is needed. An attacker sends crafted HTTP requests or induces servers to return crafted HTTP responses that pass through the inspection engine. Because LibHTP is commonly deployed in Suricata sensors monitoring perimeter traffic, any endpoint reachable by an attacker can serve as an ingress point for the malicious HTTP flow.
No public proof-of-concept exploit is listed in the enriched data. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-rqqp-24ch-248f and Open InfoSec Foundation Issue #7191.
Detection Methods for CVE-2024-45797
Indicators of Compromise
- Sustained CPU saturation on Suricata or other LibHTP-based sensors without a corresponding increase in monitored flow volume
- Rapid memory growth in inspection processes followed by packet drops or engine restarts
- HTTP traffic containing unusually high header counts or aggregate header sizes reaching hosts behind an affected sensor
Detection Strategies
- Inventory Suricata and other network security appliances to identify LibHTP versions below 0.5.49
- Alert on process resource metrics exceeding baseline for inspection daemons that link LibHTP
- Correlate sensor health degradation events with inbound HTTP flows that carry anomalous header counts
Monitoring Recommendations
- Track packet drop counters and reassembly failures on IDS sensors to catch inspection engine overload
- Log HTTP header counts and total header bytes per transaction at upstream proxies where feasible
- Watch vendor mailing lists such as the Debian LTS announcement for downstream package updates
How to Mitigate CVE-2024-45797
Immediate Actions Required
- Upgrade LibHTP to version 0.5.49 or later on all sensors and appliances that embed the library
- Update Suricata and downstream distributions that ship vulnerable LibHTP packages, including affected Debian LTS releases
- Verify that vendor-provided network security products have integrated the fixed LibHTP release
Patch Information
The fix is contained in LibHTP 0.5.49, which enforces bounded processing of HTTP request and response headers. Details are documented in the GitHub Security Advisory GHSA-rqqp-24ch-248f and tracked in Open InfoSec Foundation Issue #7191. Debian users should apply updates referenced in the Debian LTS announcement.
Workarounds
- Restrict inbound HTTP exposure to sensors while patch deployment is pending
- Enforce upstream rate limits and header size limits on load balancers or reverse proxies fronting monitored assets
- Deploy redundant inspection capacity so a single sensor overload does not eliminate visibility
# Verify installed LibHTP version on a Suricata sensor
suricata --build-info | grep -i libhtp
# Example: upgrade on Debian-based systems after repository update
sudo apt-get update
sudo apt-get install --only-upgrade libhtp2 suricata
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
