LibHTP's memory leak with lzma can lead to resource starvation
Summary
LibHTP's memory leak with lzma can lead to resource starvation
Original description
The description as published by the source.
LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled to false. This issue is fixed in version 0.5.51.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-53537 libhtp Fixed in: 1:0.5.50-1+deb13u1
- Ubuntu UBUNTU-CVE-2025-53537 libhtp Fixed in: 0.5.15-1ubuntu0.1~esm1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com