CVE-2025-63649: Monkey HTTP Server DoS Vulnerability

CVE-2025-63649 Overview

CVE-2025-63649 is an out-of-bounds read vulnerability in the Monkey HTTP server, an open-source web server developed by the monkey-project. The flaw resides in the http_parser_transfer_encoding_chunked function within mk_server/mk_http_parser.c at commit f37e984. Attackers can trigger the condition by sending a crafted POST request with a malformed Transfer-Encoding: chunked header to the server. Successful exploitation results in a Denial of Service (DoS) condition, disrupting the availability of the affected service. The vulnerability is classified under [CWE-125] (Out-of-bounds Read) and is remotely exploitable without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can crash the Monkey HTTP server by sending a single malformed chunked-encoded POST request, disrupting service availability.

Affected Products

Monkey HTTP Server (monkey-project/monkey) at commit f37e984
All deployments using the affected commit version of mk_server/mk_http_parser.c
Web services and embedded applications relying on Monkey as their HTTP front-end

Discovery Timeline

2026-01-29 - CVE-2025-63649 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-63649

Vulnerability Analysis

The vulnerability lies in how the Monkey HTTP server parses the Transfer-Encoding: chunked header within incoming POST requests. The http_parser_transfer_encoding_chunked function in mk_server/mk_http_parser.c reads beyond the bounds of an allocated buffer when processing specially crafted chunk data. This out-of-bounds read leads to a memory access violation that terminates the server process or worker thread.

Because the parser is invoked during normal HTTP request handling, no authentication or prior session establishment is required. An attacker only needs network reachability to the affected service to trigger the condition. Repeated requests can keep the service in a degraded or unavailable state, impacting any application or site fronted by the affected Monkey deployment.

Root Cause

The root cause is insufficient validation of the length and structure of chunked-encoding fields before the parser dereferences buffer offsets. When chunk-size values or chunk delimiters are absent or malformed, the parser advances its read pointer past the end of the request buffer. This results in reading uninitialized or unmapped memory, classified as [CWE-125].

Attack Vector

The attack is remote and network-based. An attacker sends an HTTP POST request with a manipulated Transfer-Encoding: chunked header where the chunk size, terminator, or body length violates the parser's expectations. The request requires no credentials, no user interaction, and no special network position. See the GitHub Security Advisory and the GitHub Issue Discussion for additional technical context.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by a crafted POST request containing
// a malformed Transfer-Encoding: chunked header processed by
// http_parser_transfer_encoding_chunked() in mk_server/mk_http_parser.c.

Detection Methods for CVE-2025-63649

Indicators of Compromise

Unexpected termination, crashes, or repeated restarts of Monkey HTTP server worker processes
HTTP POST requests containing malformed Transfer-Encoding: chunked headers or invalid chunk-size fields
Spikes in 5xx server errors or connection resets originating from a small set of source IP addresses
Core dumps or segmentation fault entries referencing mk_http_parser.c in system logs

Detection Strategies

Inspect HTTP request streams at the reverse proxy or WAF for invalid chunked-encoding patterns and reject non-conforming requests
Monitor process supervision logs (systemd, supervisord) for abnormal restart frequency of the Monkey service
Correlate web access logs with crash events to identify the source IP and request payload that preceded the failure

Monitoring Recommendations

Enable verbose error logging in Monkey and forward logs to a centralized log platform for correlation
Alert on segmentation faults or aborts in the Monkey binary via host-based monitoring
Track baseline request rates and error ratios per source IP to detect targeted DoS attempts

How to Mitigate CVE-2025-63649

Immediate Actions Required

Restrict network exposure of Monkey HTTP server instances to trusted networks where feasible
Deploy a reverse proxy or WAF in front of Monkey to validate and normalize HTTP chunked-encoding before requests reach the server
Monitor for repeated server crashes and configure automatic service recovery to limit downtime
Audit deployments to identify any production use of the vulnerable commit f37e984

Patch Information

At the time of publication, no official fixed release is referenced in the NVD entry. Operators should track the upstream project for a patched commit and consult the GitHub Security Advisory and GitHub Issue Discussion for remediation status.

Workarounds

Place Monkey behind an HTTP-aware reverse proxy such as nginx or HAProxy that strictly validates chunked-encoding
Disable acceptance of chunked transfer encoding at the proxy layer if applications do not require it
Apply rate-limiting and source-IP filtering to constrain the impact of repeated malformed requests
Replace Monkey with an actively maintained HTTP server if patch availability is uncertain for your deployment

bash

# Example: reject malformed chunked-encoded requests at nginx before reaching Monkey
# Add to server { } block of the upstream proxy
location / {
    if ($http_transfer_encoding ~* "chunked") {
        # Force HTTP/1.1 strict parsing and limit request body size
        client_max_body_size 1m;
    }
    proxy_http_version 1.1;
    proxy_request_buffering on;
    proxy_pass http://monkey_backend;
}