PatchTheCVEmonkey vulnerabilities and fixes
Recent CVEs affecting monkey, with upgrade or downgrade steps. 9 tracked.
monkey has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-01-29. Highest priority: CVE-2025-63655 (score 60/100).
- CVE-2025-63658 HIGH 7.5 UPGRADE A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows at
- CVE-2025-63657 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allo
- CVE-2025-63656 HIGH 7.5 UPGRADE An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows
- CVE-2025-63655 HIGH 7.5 UPGRADE A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984
- CVE-2025-63653 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allow
- CVE-2025-63652 HIGH 7.5 UPGRADE A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows att
- CVE-2025-63651 HIGH 7.5 UPGRADE A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows a
- CVE-2025-63650 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows a
- CVE-2025-63649 HIGH 7.5 UPGRADE An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of mo
FAQ
How do I fix monkey vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is monkey being exploited right now?
None of the tracked monkey CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which monkey CVE should I patch first?
CVE-2025-63655 currently ranks highest (60/100): A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 .