CVE-2025-53537 Details
Description
LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled` to false. This issue is fixed in version 0.5.51.
A memory leak vulnerability has been identified in LibHTP versions prior to 0.5.51, which can be triggered by traffic. This leak can deplete the process's memory resources, leading to a loss of visibility. The issue arises in the LZMA decompression handling, where an error in the decompression process is not properly managed, allowing for a gradual accumulation of unfreed memory. This vulnerability can be particularly impactful when LibHTP is used within the Suricata intrusion detection system.
Users can upgrade to LibHTP version 0.5.51 to address this vulnerability. For those using Suricata, an additional workaround is to set 'app-layer.protocols.http.libhtp.default-config.lzma-enabled' to false in the Suricata configuration file.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OISF/libhtp/commit/9037ea35110a0d97be5cedf8d31fb4cd9a38c7a7 | [email protected] | Patch |
| https://github.com/OISF/libhtp/security/advisories/GHSA-v3qq-h8mh-vph7 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oisf libhtp | < 0.5.51 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2025 | Initial Analysis | [email protected] |
| Jul 23, 2025 | New CVE Received | [email protected] |