cpp-httplib CVE-2026-46527

Exploitation requires that the target application has called Server::set_trusted_proxies() with a non-empty trusted-proxy list - this is the explicit, non-default precondition stated in the advisory; servers that do not enable this proxy-aware feature are not reachable via this code path. Beyond that, no authentication, user interaction, or special privileges are required (CVSS PR:N/UI:N): any remote attacker who can deliver an HTTP request with an X-Forwarded-For header whose value parses to no valid IP segments can trigger the crash. The exploit limits to availability impact only (VC:N/VI:N/VA:H) - no code execution or data disclosure - and effectiveness depends on whether the affected process is supervised and auto-restarted versus running as a long-lived singleton.

Signals are mostly aligned on a real but bounded risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H confirms remote, unauthenticated, low-complexity exploitation producing high availability impact and zero confidentiality/integrity impact - a clean DoS primitive. EPSS data was not provided, and the CVE is not in CISA KEV, so there is no evidence of in-the-wild use; classification is 'no public exploit identified at time of analysis.' A critical limiting factor not reflected in the CVSS base score is that the vulnerable code path is only reachable when the embedding application explicitly calls Server::set_trusted_proxies() with a non-empty list - a non-default configuration. Real-world priority should therefore be: high for production deployments running cpp-httplib behind a reverse proxy with trusted-proxy parsing enabled (common in containerized/edge setups), and low for default-configuration servers.

An attacker identifies a service built on cpp-httplib (often via fingerprinting Server headers or known products) that sits behind a reverse proxy and uses Server::set_trusted_proxies(). They send a single HTTP request with a crafted X-Forwarded-For header whose tokens parse to zero valid IP segments (e.g., an empty value or solely invalid delimiters), triggering front() on an empty vector and crashing the worker process. Repeated requests cause sustained denial of service; no public exploit identified at time of analysis, but the trigger is trivial to construct from the advisory text.