CVE-2025-63657
Published: 29 January 2026
Summary
CVE-2025-63657 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Monkey-Project Monkey. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-63657 is an out-of-bounds read vulnerability in the mk_mimetype_find function located in mk_server/mk_mimetype.c of the Monkey web server at commit f37e984. The flaw is triggered when the server processes a specially crafted HTTP request, resulting in a denial of service. It carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high availability impact, and is associated with CWE-125.
Unauthenticated remote attackers can exploit the issue by sending a malicious HTTP request to an affected Monkey instance. Successful exploitation causes the server to crash or become unresponsive, achieving denial of service without requiring credentials or user interaction.
Public references consist of a security advisory and an associated GitHub issue that provide additional technical context for the flaw. The EPSS score remains flat at 0.0131 with no material increase since disclosure, indicating limited observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206523
Vulnerability details
An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in public-facing Monkey web server directly enables remote unauthenticated DoS via crafted HTTP request (T1190 for initial exploitation of public app; T1499.004 for resulting application crash via exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this CVE by applying patches documented in the Monkey GitHub issue and Archer Security advisory to fix the out-of-bounds read.
SI-10 mandates input validation for HTTP requests, preventing crafted MIME type inputs from triggering the out-of-bounds read in mk_mimetype_find.
SC-5 provides denial-of-service protection mechanisms to limit the impact of application crashes caused by the out-of-bounds read vulnerability.