Skip to main content

Cpp Httplib CVE-2025-53628

| EUVDEUVD-2025-21053 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2025-07-10 security-advisories@github.com
Information Disclosure Cpp Httplib Suse
8.8
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-21053
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
Patch released
Mar 16, 2026 - 06:52 nvd
Patch available
PoC Detected
Aug 06, 2025 - 18:08 vuln.today
Public exploit code
CVE Published
Jul 10, 2025 - 20:15 nvd
HIGH 8.8

DescriptionGitHub Advisory

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.

AnalysisAI

CVE-2025-53628 is a memory exhaustion vulnerability in cpp-httplib versions prior to 0.20.1 that allows unauthenticated remote attackers to cause denial of service by sending HTTP requests with arbitrarily large individual header lines, exploiting the absence of per-line size limits. The vulnerability affects any application using cpp-httplib as a C++ HTTP/HTTPS library component and requires only user interaction (UI:R) to trigger, with high impact across confidentiality, integrity, and availability. No active exploitation in the wild has been confirmed, but the fix availability and related CVE-2025-53629 suggest this was discovered during security review rather than active exploitation.

Technical ContextAI

cpp-httplib is a C++11 single-file, header-only HTTP/HTTPS library providing cross-platform HTTP client/server functionality. The vulnerability resides in the HTTP header parsing logic, where the library fails to enforce maximum length constraints on individual header lines during request processing. This falls under CWE-770 (Allocation of Resources Without Limits or Throttling), a classic resource exhaustion category where unbounded allocation occurs. Unlike typical HTTP implementations that define RFC 7230-compliant limits (commonly 8KB per header line), cpp-httplib's parser accepts lines of arbitrary length, allowing an attacker to construct requests with megabyte or gigabyte-sized single headers. When the library attempts to allocate memory for these oversized lines, it can exhaust heap memory, crash the process, or degrade performance. The affected CPE would be: cpe:2.3:a:cpp-httplib:cpp-httplib:*:*:*:*:*:*:*:* with versions <0.20.1.

RemediationAI

Upgrade cpp-httplib to version 0.20.1 or later. Since cpp-httplib is header-only, update the header files in your project and recompile.; specificity: Version 0.20.1 includes fixes for CVE-2025-53628 (per-line limits) and related CVE-2025-53629 Workaround (Temporary): Implement a reverse proxy or load balancer (nginx, HAProxy, AWS ALB) in front of applications using cpp-httplib, configured with strict header size limits (e.g., nginx: client_max_header_size 8k; client_header_buffer_size 1k). This prevents oversized headers from reaching the vulnerable library.; effectiveness: High, but does not address direct client-to-server connections Defense-in-Depth: Restrict HTTP access to trusted networks or implement rate limiting on header reception. Monitor process memory usage for anomalous growth during HTTP request parsing.; effectiveness: Medium; mitigates but does not eliminate risk

More in Cpp Httplib

View all
CVE-2025-66570 CRITICAL POC
10.0 Dec 05

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow
CVE-2025-46728 HIGH POC
7.5 May 06

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Rated high severity (CVSS 7.5), this vulnerabilit
CVE-2025-52887 HIGH POC
7.5 Jun 26

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http head
CVE-2025-53629 HIGH POC
7.5 Jul 10

CVE-2025-53629 is a Denial of Service vulnerability in cpp-httplib versions prior to 0.23.0 that allows unauthenticated

CVE-2026-22776 HIGH POC
7.5 Jan 12

cpp-httplib versions prior to 0.30.1 are vulnerable to denial of service attacks due to insufficient validation of decom
CVE-2026-28435 HIGH POC
7.5 Mar 04

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 7.5 HIGH]
CVE-2026-21428 HIGH POC
7.5 Jan 01

Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request bo
CVE-2020-11709 HIGH POC
7.5 Apr 12

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, whic
CVE-2026-29076 MEDIUM POC
5.9 Mar 07

Remote denial of service in cpp-httplib prior to version 0.37.0 allows unauthenticated attackers to crash server process
CVE-2025-66577 MEDIUM POC
5.3 Dec 05

A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public Po
CVE-2026-28434 MEDIUM POC
5.3 Mar 04

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 5.3 MEDIUM]
CVE-2023-26130 HIGH
8.8 May 30

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

Ubuntu

Priority: Medium
cpp-httplib
Release Status Version
jammy needed -
noble needed -
plucky ignored end of life, was needs-triage
upstream released 0.20.1
questing needed -

Debian

Bug #1109340
cpp-httplib
Release Status Fixed Version Urgency
bookworm vulnerable 0.11.4+ds-1+deb12u1 -
forky, sid, trixie vulnerable 0.18.7-1 -
experimental fixed 0.25.0+ds-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.29 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Package Hub 15 SP6 Fixed
openSUSE Leap 15.6 Fixed

Share

CVE-2025-53628 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy