Cpp Httplib CVE-2025-53629

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates this is a highly exploitable vulnerability: network-accessible (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N/UI:N), with direct availability impact (A:H) and no confidentiality or integrity concerns. The attack surface is maximal. While EPSS data is not provided in the source data, the characteristics suggest high exploitation probability due to ease of triggering (simple HTTP request crafting). KEV (Known Exploited Vulnerability) status is not indicated, and no public POC is mentioned, suggesting either recent disclosure or limited public awareness. However, the attack is trivial to weaponize (single malicious HTTP request), making real-world risk substantial for deployed cpp-httplib instances. This is a legitimate priority for organizations using this library in production servers, particularly those exposed to untrusted networks. The lack of active exploitation signals low immediate threat, but the attack simplicity and no-auth requirement make post-patch verification critical.

An attacker crafts a malicious HTTP POST request with Transfer-Encoding: chunked header, declaring large chunk sizes (e.g., multiple multi-megabyte chunks) in sequence without providing the actual payload data, or providing minimal data. The cpp-httplib server pre-allocates buffers for these declared chunk sizes, consuming heap memory rapidly. By sending hundreds or thousands of chunk headers with large declared sizes before eventual connection timeout or closure, the attacker forces memory exhaustion on the target server. No sophisticated tooling is required—this can be accomplished with basic socket programming or modified curl commands. Example: sending a request with chunk declarations totaling terabytes while providing only kilobytes of actual data. The attack is network-accessible, requires zero authentication, and succeeds regardless of application logic. Memory exhaustion leads to service degradation, process crashes, or complete server unavailability. Mitigation complexity is low for attackers (single malicious connection), but impact is high for vulnerable servers.