Unbounded Memory Allocation Vulnerability in cpp-httplib: A Critical Security Flaw
Summary
DEBIAN-CVE-2026-45352: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only library designed for cross-platform HTTP and HTTPS communication. It is widely used for its simplicity and ease of integration into various applications. However, prior to version 0.43.4, it was found to have a significant vulnerability related to the handling of chunked Transfer-Encoding, which could lead to severe memory allocation issues.
Vulnerability Detail
The vulnerability arises from the ChunkedDecoder::read_payload function in cpp-httplib, which improperly parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). According to the C standard, strtoul accepts a leading minus sign, causing unsigned wrap-around. For instance, strtoul("-2") returns a near-maximum unsigned value, which is then stored in chunk_remaining. This leads to unbounded memory allocation, potentially causing the application to crash or become unresponsive, making it a critical security concern.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that chunk sizes are non-negative before processing them. This can be done by modifying the chunked transfer encoding handling code to reject negative values explicitly.
Conclusion
The cpp-httplib library has a critical vulnerability that allows for unbounded memory allocation due to improper handling of chunked Transfer-Encoding. It is crucial to update to version 0.43.4 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for cpp-httplib →
FAQ
The vulnerability can lead to unbounded memory allocation, causing the application to crash or become unresponsive.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, the vulnerability has been fixed in cpp-httplib version 0.43.4 and later.
If an immediate update is not possible, consider implementing input validation as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
