CVE-2026-38999: Null Pointer Dereference
Published Sep 16, 2026
·Updated
A Null Pointer Dereference in the mkschedeventclose function (mkserver/mkscheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
Affected Software
1 affected component
monkey<=4fb0c16
Event History
Sep 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to trigger this issue?
An attacker needs to be able to send a crafted HTTP request to the Monkey server. The issue is remotely reachable through the server's HTTP request handling.
2
What is the practical impact of successful exploitation?
Successful exploitation can cause a denial of service by triggering a null pointer dereference in mk_sched_event_close. The provided information does not indicate impact beyond service disruption.
3
Which Monkey versions are affected?
The issue is described as affecting Monkey through commit 4fb0c16. No release-version range is provided.