CVE-2025-63650: 
Linux Alpine vulnerability analysis and mitigation

CVE-2025-63650 is an out-of-bounds read vulnerability in the mk_ptr_to_buf function within the mk_core component (mk_memory.c) of the Monkey HTTP Server. It affects Monkey through commit f37e984 (versions up to and including 1.8.5) and allows unauthenticated remote attackers to cause a Denial of Service (DoS) by sending a crafted HTTP request. The CVE ID was requested and assigned in October 2025, with public disclosure in January 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Archer Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the mk_ptr_to_buf function in mk_core/mk_memory.c of Monkey commit f37e984. When processing a specially crafted HTTP request, the function reads memory beyond the bounds of an allocated buffer, triggering a crash and resulting in a DoS condition. Exploitation requires no authentication, no user interaction, and can be performed remotely over the network with low attack complexity. This vulnerability is one of nine reported by researcher archersec in the same codebase, including heap-buffer-overflows, use-after-free, and stack overflow issues (Archer Advisory, GitHub Issue).

Successful exploitation causes a Denial of Service by crashing the Monkey HTTP Server process, resulting in complete loss of availability for any services hosted on the affected instance. There is no confidentiality or integrity impact associated with this specific vulnerability (CVSS confidentiality and integrity impacts are rated None). Given that Monkey is a lightweight embedded HTTP server often used in IoT and resource-constrained environments, availability disruption could have significant operational consequences in those deployments (Feedly, Archer Advisory).

Proof-of-concept exploit code is publicly available on GitHub, submitted by researcher archersec as part of a coordinated disclosure covering nine vulnerabilities in Monkey commit f37e984. As of the time of disclosure, there is no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.51%, indicating a low but non-negligible probability of exploitation in the near term (Archer Advisory, GitHub Issue, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Monkey HTTP Server instances running commit f37e984 or versions up to 1.8.5 using tools such as Shodan, Censys, or banner-grabbing utilities.
2. Craft malicious HTTP request: Construct a specially crafted HTTP request designed to trigger the out-of-bounds read in the mk_ptr_to_buf function within mk_core/mk_memory.c. The exact payload structure is detailed in the PoC archive (monkey-poc.zip) published by archersec.
3. Send request to target: Transmit the crafted HTTP request to the target Monkey server over the network. No authentication or special privileges are required.
4. Trigger DoS: The malformed request causes the server to read beyond the bounds of an allocated memory buffer in mk_ptr_to_buf, resulting in a crash and denial of service for all clients connected to the server (Archer Advisory, GitHub Issue).

• Network: Unusual or malformed HTTP requests to the Monkey HTTP Server, particularly requests with anomalous headers or body structures that deviate from RFC standards; repeated connection attempts from a single source IP targeting the HTTP port.
• Logs: Monkey server crash logs or segmentation fault entries in system logs (e.g., /var/log/syslog or dmesg) coinciding with inbound HTTP requests; abrupt termination of the monkey process.
• Process: Unexpected termination or restart of the Monkey HTTP Server process; core dump files generated in the working directory of the Monkey process following a crash (Archer Advisory).

As of the disclosure date (January 2026), no patch has been released for this vulnerability; all versions of Monkey through commit f37e984 (up to and including 1.8.5) remain affected. Organizations should implement network-level access controls (e.g., firewall rules) to restrict HTTP access to Monkey servers to trusted IP ranges only. If the Monkey HTTP Server is not actively required, it should be disabled or replaced with a patched alternative. Monitor the Monkey GitHub repository for any future patches or commits addressing these issues (Archer Advisory, Feedly).

The vulnerability was reported by security researcher archersec, who disclosed nine vulnerabilities in the Monkey HTTP Server simultaneously in January 2026 after CVE IDs were assigned in October 2025. The GitHub issue (#426) was closed without a fix being committed, reflecting the project's limited maintenance activity. Red Hat tracked the CVE in their security advisory database. No significant broader media coverage or notable community commentary beyond the original disclosure has been identified (GitHub Issue, Red Hat Advisory).