A memory leak vulnerability in the OISF libhtp library, version 0.5.50 and below, poses a significant denial of service risk by enabling resource exhaustion through specially crafted traffic.

This vulnerability is classified as a missing release of memory after effective lifetime (CWE-401). It can be triggered by an unauthenticated remote attacker through traffic-induced memory exhaustion, effectively causing the application process to crash or become unresponsive.

The primary impact of this vulnerability is the loss of system availability and network traffic visibility. Because libhtp is a core component for security-aware parsing, a successful exploit could blind security monitoring tools, such as Suricata, to malicious activity occurring on the network. With a CVSS score of 7.5, the risk is considered high due to the ease of remote exploitation and the potential for complete service disruption.

Immediate Action: Update libhtp to version 0.5.51 or higher to resolve the underlying memory leak.

Proactive Monitoring: Monitor system memory usage for unusual spikes and review application logs for errors related to memory allocation or service restarts.

Compensating Controls: If immediate patching is not feasible, implement the suggested workaround by setting the configuration parameter suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled to false.

Public Exploit Available: No (exploit_available: unknown)

Given that this vulnerability allows for unauthenticated denial of service and directly impacts security visibility, it should be addressed with high urgency. Organizations relying on libhtp for deep packet inspection or traffic analysis must prioritize the update to version 0.5.51 to ensure continued operational integrity and monitoring efficacy.