CVE-2025-63655: 
Linux Alpine vulnerability analysis and mitigation

CVE-2025-63655 is a NULL pointer dereference vulnerability in the mk_http_range_parse function (mk_server/mk_http.c) of the Monkey HTTP Server, affecting commit f37e984 and all versions through 1.8.5. An unauthenticated remote attacker can trigger a server crash by sending a specially crafted HTTP request containing a malformed Range header, resulting in a Denial of Service (DoS). The CVE ID was requested and assigned in October 2025, with public disclosure in January 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Archer Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in the mk_http_range_parse function in mk_server/mk_http.c. When an HTTP request includes a Range header whose value starts with bytes followed immediately by a null byte (\0), and the subsequent content contains a dash before an equal sign (e.g., Range: bytes\0-=), the condition eq_pos > sep_pos is triggered at line 478. This causes mk_string_copy_substr to return a null pointer for buffer, which is then passed to atol, resulting in a segmentation fault. No authentication, user interaction, or special privileges are required to trigger this condition — only network access to the server (Monkey Issue #427, Archer Advisory).

Successful exploitation causes the Monkey HTTP Server process to crash via a segmentation fault, rendering the web server unavailable to legitimate users and resulting in a complete availability impact. There is no confidentiality or integrity impact, as the vulnerability only affects availability. Because the attack requires no authentication and can be executed remotely over the network, any internet-exposed Monkey HTTP Server instance running commit f37e984 or earlier (up to version 1.8.5) is at risk (Feedly, Archer Advisory).

Proof-of-concept exploit code is publicly available via the researcher's GitHub advisory and the linked monkey project issue, including a PoC archive (monkey-poc-2.zip) (Monkey Issue #427, Archer Advisory). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.0081 (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing Monkey HTTP Server instances (versions ≤ 1.8.5 / commit f37e984) using tools such as Shodan or Censys, searching for the Monkey HTTP Server banner.
2. Craft malicious HTTP request: Construct an HTTP request that includes a Range header with a value starting with bytes, immediately followed by a null byte (\0), then a dash and an equal sign — for example: Range: bytes\0-=.
3. Send the request: Transmit the crafted HTTP request to the target server over the network (no authentication required). Tools such as curl, netcat, or a custom Python script can be used to send raw HTTP requests with the malformed header.
4. Trigger NULL pointer dereference: The mk_http_range_parse function evaluates eq_pos > sep_pos, causing mk_string_copy_substr to return a null pointer, which is then passed to atol, triggering a segmentation fault.
5. Achieve DoS: The server process crashes, making the Monkey HTTP Server unavailable to legitimate users until it is manually restarted (Monkey Issue #427, Archer Advisory).

• Network: Unusual HTTP requests containing a Range header with the pattern bytes\0-= or similar malformed byte sequences; repeated connection attempts from a single source IP targeting the Monkey HTTP Server.
• Logs: Monkey HTTP Server access logs showing requests with anomalous Range header values; error logs or system logs recording segmentation fault or process crash events for the monkey process.
• Process: Unexpected termination or restart of the monkey server process; OS-level crash reports (e.g., core dumps) generated by the Monkey HTTP Server process (Monkey Issue #427).

As of the time of disclosure, no official patch has been released by the Monkey project for this vulnerability (Archer Advisory). Organizations should consider the following interim mitigations: (1) Implement network-level access controls (firewall rules, WAF) to restrict HTTP access to trusted sources only; (2) Monitor for anomalous Range header patterns in HTTP traffic; (3) Evaluate migration to an actively maintained web server; (4) Monitor the Monkey project repository for any future patches or fixes. Upgrading beyond version 1.8.5 is not currently possible as no fixed release exists.

The vulnerability was reported by researcher archersec in October 2025 alongside several other Monkey HTTP Server vulnerabilities (CVE-2025-63649 through CVE-2025-63658), all disclosed publicly in January 2026. The researcher noted that none of the reported issues had been fixed at the time of disclosure and filed a detailed GitHub issue with a PoC archive (Monkey Issue #427, Archer Advisory). No significant vendor response or broader media coverage has been observed beyond standard CVE database entries.