PT-2026-5341 · Monkey · Monkeyd

Published 2026-01-29 · Updated 2026-02-03 · CVE-2025-63655

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Monkey versions prior to commit f37e984

Description A flaw exists in the mk http range parse function located in mk server/mk http.c that can lead to a Denial of Service (DoS). This occurs when a specially crafted HTTP request is sent to the server, causing a NULL pointer dereference. The vulnerable function is mk http range parse().

Recommendations Update to commit f37e984 or later to address this issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-76358

AZL-76380

CVE-2025-63655

Affected Products

Monkeyd

References · 9

• 🔥 https://github.com/monkey/monkey/issues/427 · Exploit
• 🔥 https://github.com/archersec/security-advisories/blob/master/monkey/monkey-advisory-2025.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63655 · Security Note
• https://osv.dev/vulnerability/AZL-76358 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76380 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-63655 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2017011612020805760 · Twitter Post
• https://t.me/cveNotify/150766 · Telegram Post
• https://twitter.com/CVEnew/status/2016970906367606931 · Twitter Post