{"id":"CVE-2024-28871","summary":"Excessive CPU used on malformed traffic","details":"LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available.","aliases":["GHSA-ffr2-45w9-7wmg"],"modified":"2026-08-12T15:15:09.731293Z","published":"2024-04-04T14:46:02.803Z","related":["openSUSE-SU-2024:14016-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28871.json"},"references":[{"type":"WEB","url":"https://redmine.openinfosecfoundation.org/issues/6757"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28871.json"},{"type":"ADVISORY","url":"https://github.com/OISF/libhtp/security/advisories/GHSA-ffr2-45w9-7wmg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28871"},{"type":"FIX","url":"https://github.com/OISF/libhtp/commit/79e713f3e527593a45f545e854cd9e6fbb3cd3ed"},{"type":"FIX","url":"https://github.com/OISF/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oisf/libhtp","events":[{"introduced":"3b9ed734874e8bf64f1239abac42f77e99cfd906"},{"fixed":"79e713f3e527593a45f545e854cd9e6fbb3cd3ed"},{"fixed":"bf618ec7f243cebfb0f7e84c3cb158955cb32b4d"}],"database_specific":{"cpe":"cpe:2.3:a:oisf:libhtp:0.5.46:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.5.46"},{"last_affected":"0.5.46"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.5.46","= 0.5.46"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/oisf/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d","target":{"file":"test/test_main.cpp"},"deprecated":false,"digest":{"line_hashes":["318172770935594959350941458745435307763","135239512933602376594045183615727728699","131700058990156315402314416600437322377","277994319879901349994914593103939313737"],"threshold":0.9},"id":"CVE-2024-28871-3ed3ea6c","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/oisf/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d","target":{"file":"test/test_main.cpp","function":"TEST_F"},"deprecated":false,"digest":{"length":354,"function_hash":"148640750141087490866965115654957542471"},"id":"CVE-2024-28871-42916d96"},{"source":"https://github.com/oisf/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d","target":{"file":"htp/htp_request.c"},"deprecated":false,"digest":{"line_hashes":["267359046665290570769923342758498273095","303551294191400035276263804370023306921","119839181945903624091477649627408790864","161212438092718958504047245052704100794","150200054387931348240854522730784242602","207265992600273278446008837170369875565","94233397943067680948929258014963379952","177308729534991442599318098923060054484","147060639569616060088023905671536173844","74451318637906718655269567190115454574","9565752617086491266711890594113080014","257183742756321029938664592568116238449","163640541665630402471706784285028629","327832901355841139650099125053069665217","298221389295221802504942701590661372085"],"threshold":0.9},"id":"CVE-2024-28871-5f9a7a33","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/oisf/libhtp/commit/bf618ec7f243cebfb0f7e84c3cb158955cb32b4d","target":{"file":"htp/htp_request.c","function":"htp_connp_REQ_PROTOCOL"},"deprecated":false,"digest":{"length":831,"function_hash":"42034569953756389800674741515598562518"},"id":"CVE-2024-28871-7dd59a4d","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28871.json","vanir_signatures_modified":"2026-08-12T15:15:09Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}