CVE-2025-63655: Null Pointer Dereference
Published Jan 29, 2026
·Updated
A NULL pointer dereference in the mkhttprangeparse function (mkserver/mkhttp.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
Affected Software
2 affected components
monkey
Monkey-project Monkey<=1.8.5
Event History
Jan 29, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-63655?
CVE-2025-63655 has a high severity due to its ability to cause Denial of Service (DoS) with a crafted HTTP request.
2
How do I fix CVE-2025-63655?
To fix CVE-2025-63655, update the Monkey server to version 1.8.6 or later, as this version addresses the vulnerability.
3
What specific function is affected by CVE-2025-63655?
CVE-2025-63655 affects the mk_http_range_parse function in the Monkey server.
4
Which versions of Monkey are affected by CVE-2025-63655?
Monkey versions up to and including 1.8.5 are affected by CVE-2025-63655.
5
Can CVE-2025-63655 be exploited remotely?
Yes, CVE-2025-63655 can be exploited remotely by sending specially crafted HTTP requests to the server.