A vulnerability in the Melon C library allows unauthenticated remote attackers to cause a denial of service by sending excessively large HTTP request headers.

The HTTP component lacks a maximum length constraint for request headers. An unauthenticated attacker can exploit this by submitting oversized headers, which causes the application to consume excessive system RAM and results in a denial of service.

The ability for an unauthenticated attacker to remotely crash a service poses a significant risk to system availability and business continuity. With a CVSS score of 7.5, this vulnerability is considered High severity, as it requires no user interaction or prior authentication to disrupt critical application functions.

Immediate Action: Since a specific patch is not currently available, monitor the vendor repository for upcoming commits that implement header length validation.

Proactive Monitoring: Review application logs for unusually large HTTP requests or sudden spikes in memory consumption that may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) or load balancer to enforce strict limits on HTTP request header sizes before traffic reaches the Melon-based service.

Public Exploit Available: Yes — a technical write-up and proof-of-concept are available via the researcher's gitbook documentation referenced by the CVE.

Given the availability of a public proof-of-concept and the ease of exploitation, organizations utilizing the Melon library should prioritize the implementation of boundary checks at the network perimeter. Until a vendor-supplied patch is released, strict request size filtering is required to mitigate the risk of service disruption.