Stack Overflow Vulnerability in cpp-httplib Package Due to Uncontrolled Stack Growth
Summary
DEBIAN-CVE-2026-29076: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.26.0+ds-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library designed for simplicity and ease of use. It allows developers to easily integrate HTTP functionalities into their applications. However, prior to version 0.37.0, cpp-httplib had a vulnerability related to the parsing of RFC 5987 encoded filename* values in multipart Content-Disposition headers, which could lead to severe security issues.
Vulnerability Detail
The vulnerability arises from cpp-httplib's use of std::regex (libstdc++) to parse multipart Content-Disposition headers. The regex engine in libstdc++ employs deep recursion for backtracking, which can lead to uncontrolled stack growth when processing specially crafted filename* parameters. An attacker can exploit this by sending a single HTTP POST request with a malicious filename* parameter, causing a stack overflow (SIGSEGV) that crashes the server process. This vulnerability is critical as it can lead to denial of service and potential exploitation of the server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the filename* parameters before processing them, although this may not fully mitigate the risk associated with the vulnerability.
Conclusion
In summary, the cpp-httplib package has a significant vulnerability related to stack overflow due to improper handling of multipart Content-Disposition headers. It is crucial to update to version 0.37.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for cpp-httplib →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
All versions prior to 0.37.0 of cpp-httplib are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to a denial of service, causing the server to crash and potentially allowing attackers to disrupt service availability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
