CVE-2025-63658: 
Linux Alpine vulnerability analysis and mitigation

CVE-2025-63658 is a stack-based buffer overflow vulnerability in the mk_http_index_lookup function (mk_server/mk_http.c) of the Monkey HTTP Server. It affects Monkey versions up to and including 1.8.5 (specifically commit f37e984). An unauthenticated remote attacker can send a crafted HTTP request to trigger a stack overflow, resulting in Denial of Service (DoS) or potentially Remote Code Execution (RCE). The CVE was requested and assigned in October 2025 and publicly disclosed in January 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Feedly, Archer Advisory).

The root cause is a stack-based buffer overflow (CWE-121) in mk_http_index_lookup within mk_server/mk_http.c. When a request URL begins with a slash followed by a null byte (\0), the mk_http_init function calls mk_file_get_info and incorrectly identifies the URL as the root directory (htdocs), bypassing the ret_file check at line 803. An attacker can then craft a URL whose length exceeds the tmppath array size (MK_MAX_PATH, 1024 bytes); when mk_http_init subsequently calls mk_http_index_lookup, the function copies the excess URL data beyond the array boundary onto the stack, causing the overflow. The researcher notes this may enable RCE in addition to DoS (GitHub Issue #427, Archer Advisory).

Successful exploitation causes the Monkey HTTP Server process to crash, resulting in a complete loss of availability for any services hosted on the affected instance. Because the overflow corrupts stack memory, there is a potential — though not yet demonstrated in the wild — for an attacker to achieve Remote Code Execution, which would additionally compromise confidentiality and integrity of the host system. No authentication or user interaction is required, making any internet-exposed Monkey server running commit f37e984 or earlier (up to v1.8.5) directly at risk (Archer Advisory, Feedly).

Proof-of-concept exploit code is publicly available via the researcher's security advisory and the linked GitHub issue, including a PoC archive (monkey-poc-2.zip) (GitHub Issue #427, Archer Advisory). No evidence of in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity. The EPSS score is approximately 0.31%, indicating a currently low (but non-negligible) probability of exploitation in the near term. CVE-2025-63658 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing Monkey HTTP Server instances running commit f37e984 or version ≤1.8.5 using network scanners (e.g., Shodan, Censys) or banner grabbing tools.
2. Craft malicious URL: Construct an HTTP GET request with a URL that begins with /\0 (slash followed by a null byte) to bypass the ret_file check in mk_http_init and cause the server to treat the path as the root htdocs directory.
3. Overflow the buffer: Extend the crafted URL beyond 1024 bytes (MK_MAX_PATH) so that when mk_http_index_lookup copies the URL into the tmppath stack buffer, the excess data overflows onto adjacent stack memory.
4. Trigger DoS or RCE: Send the crafted request to the target server. At minimum, the server process crashes (DoS). With a carefully crafted payload controlling the overflow data, an attacker may attempt to redirect execution flow for RCE (GitHub Issue #427, Archer Advisory).

• Network: Inbound HTTP GET requests with URLs starting with /\0 (slash + null byte) followed by a long path exceeding 1024 characters targeting the Monkey HTTP Server port.
• Network: Unusually large HTTP request URLs (>1024 bytes) directed at the server's listening port from external or unexpected sources.
• Logs: Monkey HTTP Server access logs showing requests with malformed or oversized URL paths; server error logs indicating crashes or abnormal termination of the monkey process.
• Process: Unexpected termination or restart of the monkey server process; core dump files generated in the Monkey working directory following a crash.
• File System: Presence of monkey-poc-2.zip or related PoC files on attacker-controlled systems that have interacted with the server (GitHub Issue #427).

At the time of disclosure, no official patch had been released for Monkey commit f37e984 / version 1.8.5; the vulnerability was reported as unfixed in the advisory (Archer Advisory). Organizations should monitor the Monkey GitHub repository for any commits or releases that address this issue and upgrade as soon as a fix is available. As interim mitigations, restrict HTTP access to the Monkey server to trusted IP ranges using firewall rules or network ACLs, deploy a reverse proxy or WAF to filter malformed or oversized HTTP requests, and consider disabling the Monkey server if it is not essential (Feedly).

The vulnerability was reported by researcher archersec, who disclosed a batch of multiple CVEs (CVE-2025-63649 through CVE-2025-63658) affecting Monkey HTTP Server in a coordinated advisory published in January 2026 (Archer Advisory). Red Hat acknowledged the CVE in their security tracking database (Red Hat CVE). No significant broader media coverage or notable community discussion beyond the GitHub issue and advisory has been identified.