EUVD-2026-33425Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated request with no interaction and low complexity triggers a crash, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H), no C/I loss.
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.
AnalysisAI
Denial of service in cpp-httplib before 0.43.4 lets remote unauthenticated attackers crash the server by sending a chunked HTTP request with a negative chunk-size value. Because ChunkedDecoder::read_payload parses the size with std::strtoul(), a value like "-2" wraps to a near-maximum unsigned integer (0xFFFFFFFFFFFFFFFE) that bypasses the library's single guard against ULONG_MAX, driving unbounded memory allocation and a process crash. Publicly available exploit code exists (SSVC: PoC) though it is not in CISA KEV, and EPSS is low at 0.06%.
Technical ContextAI
cpp-httplib is a widely-embedded single-file, header-only C++11 HTTP/HTTPS library used to add server or client capabilities to native applications. The flaw is a classic CWE-20 Improper Input Validation of the chunk-size field in HTTP/1.1 chunked Transfer-Encoding. Per C standard §7.22.1.4, std::strtoul() silently accepts a leading minus sign and performs unsigned wrap-around, so strtoul("-2", …, 16) yields ULONG_MAX − 1. The only sanity check (httplib.h line 12833) rejects exactly ULONG_MAX (the "-1" case) but not other negatives, so the wrapped value lands in chunk_remaining and dictates how many bytes the read loop attempts to consume, leading to unbounded allocation/consumption. Affected product per CPE is cpe:2.3:a:yhirose:cpp-httplib:*.
RemediationAI
Vendor-released patch: 0.43.4 - upgrade the bundled httplib.h to 0.43.4 or later and rebuild every application that statically includes it, since header-only distribution means each consumer must recompile. Track down all vendored copies across your codebases, as a single stale header leaves the service exposed. If immediate patching is not possible, place the cpp-httplib endpoint behind a reverse proxy or WAF that normalizes/validates HTTP chunked Transfer-Encoding and rejects malformed or negative chunk-size fields, and restrict network exposure of the affected service to trusted clients; note this adds an infrastructure dependency and may not catch every malformed-chunk variant, so it is a stopgap rather than a fix. Refer to the advisory at https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8.
More in Cpp Httplib
View allcpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow
CVE-2025-53628 is a memory exhaustion vulnerability in cpp-httplib versions prior to 0.20.1 that allows unauthenticated
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Rated high severity (CVSS 7.5), this vulnerabilit
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http head
CVE-2025-53629 is a Denial of Service vulnerability in cpp-httplib versions prior to 0.23.0 that allows unauthenticated
cpp-httplib versions prior to 0.30.1 are vulnerable to denial of service attacks due to insufficient validation of decom
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 7.5 HIGH]
Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request bo
cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, whic
HTTP response/header injection in cpp-httplib server versions prior to 0.44.0 allows remote unauthenticated attackers to
Remote denial of service in cpp-httplib prior to version 0.37.0 allows unauthenticated attackers to crash server process
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public Po
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| openSUSE Leap 16.0 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today