Junglewise Threat Intelligence

CVE-2026-38999: Monkey HTTP Server null pointer dereference in scheduler

CVE-2026-38999 · Severity: high · CVSS 7.5 · Published 2026-09-16

Executive brief

Monkey is an open-source lightweight HTTP web server used to serve web content on embedded systems and resource-constrained environments. A null pointer dereference flaw in the scheduler event handler can be triggered by sending a specially crafted HTTP request, causing the server to crash and become unavailable to legitimate users.

Technical details

A null pointer dereference vulnerability exists in the mk_sched_event_close function within mk_server/mk_scheduler.c. The vulnerability is triggered when a crafted HTTP request is sent to the server, causing the event scheduler to attempt to dereference a null pointer. The attack requires only network access to send a malicious HTTP request; no authentication is needed. Successful exploitation results in a Denial of Service condition that crashes the Monkey HTTP server process. The vulnerability has been fixed in commit fc1d68fb38044df08cb43c7d9af0f68714388efc.

Affected products

  • Monkey Monkey HTTP Server through commit 4fb0c16

Timeline

  • 2026-04: disclosed: CVE ID requested
  • 2026-06: advisory: CVE ID assigned
  • 2026: patched: Fixed in commit fc1d68fb38044df08cb43c7d9af0f68714388efc

References