CVE-2025-63649
BaseFortify
Publication date: 2026-01-29
Last updated on: 2026-02-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| monkey-project | monkey | to 1.8.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read in the http_parser_transfer_encoding_chunked function of the Monkey HTTP server. It occurs when the server processes a specially crafted POST request, allowing attackers to cause a Denial of Service (DoS) by making the server read memory outside the intended bounds. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability can involve monitoring for unusual or crafted POST requests that trigger the out-of-bounds read in the monkey HTTP server. Since proof-of-concept exploits are available (e.g., in the monkey-poc.zip mentioned in Resource 2), you can use those to test your server. Network monitoring tools like tcpdump or Wireshark can capture POST requests for analysis. Additionally, running the provided proof-of-concept exploit against a test instance of your server can help confirm vulnerability. Specific commands are not detailed in the provided resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Monkey HTTP server to a version that patches these vulnerabilities once available. Until then, restricting or filtering POST requests to the server, especially those with suspicious or malformed transfer-encoding headers, can reduce exposure. Monitoring server logs for crashes or unusual behavior may also help detect exploitation attempts. No specific patch or workaround commands are provided in the resources. [2]
How can this vulnerability impact me? :
The vulnerability can impact you by causing a Denial of Service (DoS) on the Monkey HTTP server. Attackers can exploit this by sending crafted POST requests that trigger the out-of-bounds read, potentially crashing the server or making it unavailable to legitimate users.