PatchTheCVEmonkey-project vulnerabilities
Recent CVEs affecting monkey-project products. 9 tracked.
monkey-project has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2026-01-29. Highest priority: CVE-2025-63655 (score 60/100).
- CVE-2025-63658 HIGH 7.5 UPGRADE A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows at
- CVE-2025-63657 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allo
- CVE-2025-63656 HIGH 7.5 UPGRADE An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows
- CVE-2025-63655 HIGH 7.5 UPGRADE A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984
- CVE-2025-63653 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allow
- CVE-2025-63652 HIGH 7.5 UPGRADE A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows att
- CVE-2025-63651 HIGH 7.5 UPGRADE A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows a
- CVE-2025-63650 HIGH 7.5 UPGRADE An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows a
- CVE-2025-63649 HIGH 7.5 UPGRADE An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of mo
FAQ
How do I fix monkey-project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is monkey-project being exploited right now?
None of the tracked monkey-project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which monkey-project CVE should I patch first?
CVE-2025-63655 currently ranks highest (60/100): A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 .