CVE-2024-28871

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. Version 0.5.46 may parse malformed request traffic, leading to excessive CPU usage. Version 0.5.47 contains a patch for the issue. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
OISFlibhtp= 0.5.46
oisflibhtp0.5.46

References

Timeline

Published
Apr 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-288728.1The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the SCVE-2024-288758.1A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theCVE-2024-288767.3Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enableCVE-2024-288778.8MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected inCVE-2024-288789.6IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without sufficiently verifying thCVE-2024-28885.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldCVE-2024-288806.5Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitCVE-2024-288816.7Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potenCVE-2024-288824.3OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the valiCVE-2024-288837.4An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may alloCVE-2024-288855.9Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network aCVE-2024-288868.4OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.us