Memory Exhaustion Vulnerability in cpp-httplib: Uncontrolled Memory Allocation via Chunked Requests

Background

cpp-httplib is a C++ header-only library that provides HTTP and HTTPS server and client functionalities. It is designed for simplicity and ease of use, allowing developers to integrate HTTP capabilities into their applications without the need for extensive configuration. However, prior to version 0.20.1, cpp-httplib had a critical vulnerability that allowed attackers to exploit the library's handling of incoming request bodies, particularly when using chunked transfer encoding or omitting the Content-Length header.

Vulnerability Detail

The vulnerability arises from the library's failure to enforce size limits on incoming request bodies when 'Transfer-Encoding: chunked' is utilized or when no 'Content-Length' header is present. This oversight allows a remote attacker to send a chunked request that lacks the terminating zero-length chunk, leading to uncontrolled memory allocation on the server. As a result, the server may experience memory exhaustion, causing it to crash or become unresponsive. The issue has been addressed in version 0.20.1, which implements strict limits during the parsing of incoming requests.

Workaround

If immediate updating is not feasible, a short-term workaround is to deploy a reverse proxy in front of the cpp-httplib application. For instance, you can use Nginx or HAProxy to enforce maximum request body size limits. Below is an example configuration for Nginx:

server {

    listen 80;
    server_name your_domain.com;

    location / {
        client_max_body_size 1M;  # Set your desired limit
        proxy_pass http://localhost:YOUR_CPP_HTTPLIB_PORT;
    }
}

Conclusion

The cpp-httplib library has a critical vulnerability that can lead to memory exhaustion due to improper handling of incoming request bodies. It is essential to update to version 0.20.1 or later to mitigate this risk. Alternatively, deploying a reverse proxy can serve as a temporary solution until the library is updated.

See every vulnerability recorded for cpp-httplib →

FAQ