Cpp Httplib CVE-2025-53628

CVSS 8.8 (High) with attack vector Network, low complexity, no privileges required, user interaction required signals substantial risk, but several factors warrant nuanced interpretation: (1) CVSS vector impact (C:H/I:H/A:H) may be overstated—this is primarily a Denial of Service (availability impact) rather than data breach or code execution; the confidentiality and integrity ratings likely reflect downstream consequences of service compromise rather than direct information disclosure; (2) Attack complexity is Low and requires Network access with no authentication, making it broadly exploitable; (3) User Interaction requirement (UI:R) suggests the vulnerability requires user-controlled input or a user visiting a malicious endpoint, which is partially mitigated by normal HTTP client behavior; (4) No confirmed KEV/CISA status or public POC availability noted, suggesting limited real-world exploitation pressure; (5) EPSS score not provided, but based on the profile (low-complexity, network-accessible, DoS-capable resource exhaustion), exploitation probability is likely moderate to high; (6) Relatedness to CVE-2025-53629 suggests a systematic review of input validation, potentially identifying additional variants. Real-world priority: High for internet-facing services or those receiving untrusted HTTP input, but medium for internal/trusted environments. This is a genuine availability threat, not a false-positive high-CVSS issue.

An attacker crafts an HTTP GET request with a single header field (e.g., User-Agent) containing a multi-megabyte payload of repeated characters, or constructs a series of requests each with a large header to accumulate memory consumption. The request is sent to a cpp-httplib-based HTTP server (e.g., a REST API, web service, or embedded HTTP interface) running version < 0.20.1. The vulnerable parser allocates memory without enforcing size limits, consuming RAM linearly with the header size. With multiple concurrent requests or iterative attacks, the process exhausts available memory, leading to Out-of-Memory (OOM) conditions, process crash, or severe performance degradation. Example vector: POST /api/endpoint HTTP/1.1 Host: target.com X-Large-Header: [1GB of 'A' characters]

. No authentication or special privileges are required; the attacker only needs network access and the ability to send malformed HTTP. The UI:R flag likely reflects that the server operator must be "accepting" untrusted HTTP input (which is typical for public-facing HTTP services). No known public POC has been disclosed, but the vulnerability is straightforward to exploit once discovered.