CVE-2025-63651
Published: 29 January 2026
Summary
CVE-2025-63651 is a high-severity Use After Free (CWE-416) vulnerability in Monkey-Project Monkey. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and timely remediation of the use-after-free flaw in the Monkey web server's mk_string_char_search function to prevent exploitation.
Implements memory protection mechanisms such as address space layout randomization and stack canaries to mitigate use-after-free vulnerabilities exploited by crafted HTTP requests.
Provides denial-of-service protections to limit the impact of service crashes or interruptions caused by the use-after-free triggered by malicious HTTP requests.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in public-facing Monkey web server directly enables remote unauthenticated exploitation via crafted HTTP request for DoS impact.
NVD Description
A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
Deeper analysisAI
CVE-2025-63651 is a use-after-free vulnerability in the mk_string_char_search function within mk_core/mk_string.c of the Monkey web server at commit f37e984. Published on 2026-01-29, this flaw (CWE-416) enables attackers to induce a Denial of Service (DoS) by sending a crafted HTTP request to the server, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation involves crafting and sending a malicious HTTP request, which triggers the use-after-free condition and disrupts server availability, potentially leading to crashes or service interruptions.
Security advisories provide further details on mitigation, available at https://github.com/archersec/security-advisories/blob/master/monkey/monkey-advisory-2025.md and in the Monkey project's issue tracker at https://github.com/monkey/monkey/issues/426.
Details
- CWE(s)