Executive brief
Monkey is an open-source lightweight HTTP web server used to serve web content on embedded systems and resource-constrained environments. A null pointer dereference flaw in the scheduler event handler can be triggered by sending a specially crafted HTTP request, causing the server to crash and become unavailable to legitimate users.
Technical details
A null pointer dereference vulnerability exists in the mk_sched_event_close function within mk_server/mk_scheduler.c. The vulnerability is triggered when a crafted HTTP request is sent to the server, causing the event scheduler to attempt to dereference a null pointer. The attack requires only network access to send a malicious HTTP request; no authentication is needed. Successful exploitation results in a Denial of Service condition that crashes the Monkey HTTP server process. The vulnerability has been fixed in commit fc1d68fb38044df08cb43c7d9af0f68714388efc.
Affected products
- Monkey Monkey HTTP Server through commit 4fb0c16
Timeline
- 2026-04: disclosed: CVE ID requested
- 2026-06: advisory: CVE ID assigned
- 2026: patched: Fixed in commit fc1d68fb38044df08cb43c7d9af0f68714388efc