cpp-httplib CVE-2026-45352

Exploitation requires the target application to use cpp-httplib's HTTP server to receive requests with chunked Transfer-Encoding (the default HTTP/1.1 path for streamed request bodies) and to be reachable over the network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity, so no special configuration is needed beyond an exposed cpp-httplib < 0.43.4 endpoint that accepts chunked request bodies. Limiting factors: the impact is confined to availability (process crash/memory exhaustion) with no code execution or data disclosure, and reach depends on the embedded library actually being network-exposed rather than used only as an internal or client component.

Signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, base 7.5) reflects remote, low-complexity, unauthenticated exploitation with pure availability impact - no confidentiality or integrity loss. SSVC aligns: exploitation=PoC, automatable=yes, technical impact=partial, meaning a crash rather than code execution or data compromise. EPSS is low (0.06%, 18th percentile) and the CVE is not in CISA KEV, so there is no evidence of widespread active exploitation; the PoC-plus-automatable combination nonetheless makes opportunistic crash attempts plausible. This is a real patch-worthy DoS but not a code-execution emergency; prioritize based on whether your cpp-httplib server is internet-exposed.

An attacker sends a single crafted HTTP request to an exposed cpp-httplib server using chunked Transfer-Encoding with a chunk-size of "-2", which passes the library's guard and wraps to a near-maximum byte count. The server's read loop then attempts to consume an enormous amount of data, exhausting memory and crashing the process. With PoC code available and the attack automatable and unauthenticated, this can be scripted for repeated remote denial of service.