Vulnerability · Published Jul 23, 2025 · Assigned by GitHub_M

CVE-2025-53537LibHTP's memory leak with lzma can lead to resource starvation

High 7.5

In plain English

A high-severity memory leak in libhtp from OISF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled` to false. This issue is fixed in version 0.5.51.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	libhtp	1:0.5.50-1+deb13u1	DEBIAN-CVE-2025-53537
Ubuntu:25.10	libhtp	no fix listed	UBUNTU-CVE-2025-53537
Ubuntu:26.04:LTS	libhtp	no fix listed	UBUNTU-CVE-2025-53537

Affected products (as reported)

Vendor	Product	Versions
OISF	libhtp	< 0.5.51

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/OISF/libhtp/security/advisories/GHSA-v3qq-h8mh-vph7 x_refsource_CONFIRM
https://github.com/OISF/libhtp/commit/9037ea35110a0d97be5cedf8d31fb4cd9a38c7a7 x_refsource_MISC