Memory Exhaustion Vulnerability in cpp-httplib Package
Summary
CVE-2025-52887: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib across 2 version ranges.
< 3a1f379e751ef6555f06c5c1ef367a6fce26722c
< 28dcf379e82a2cdb544d812696a7fd46067eb7f9
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library designed for ease of use and integration into various applications. It provides a simple interface for making HTTP requests and handling responses, making it a popular choice among developers for building web services. However, the library is susceptible to a memory exhaustion vulnerability that can lead to server crashes or unresponsiveness when handling excessive HTTP headers.
Vulnerability Detail
In version 0.21.0 of cpp-httplib, there is a critical vulnerability that arises when an excessive number of HTTP header fields are passed to the library. The library does not impose a limit on the number of headers, leading to unbounded memory allocation. When the connection is disconnected, the memory associated with these headers is not released, resulting in potential exhaustion of system memory. This can cause the server to crash or become unresponsive, severely impacting service availability and performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the number of HTTP headers being sent in requests to the cpp-httplib library. This can be done by implementing checks in your application code to restrict the number of headers to a reasonable limit before making requests.
Conclusion
The cpp-httplib package has a memory exhaustion vulnerability in version 0.21.0 that can lead to server crashes when handling excessive HTTP headers. Updating to version 0.22.0 or later is crucial to mitigate this risk. Implementing temporary workarounds can help manage the issue until an update can be applied.
See every vulnerability recorded for cpp-httplib →
FAQ
The vulnerability can lead to memory exhaustion, causing the server to crash or become unresponsive when too many HTTP headers are processed.
Versions prior to 0.22.0 are affected by this vulnerability, specifically version 0.21.0.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, version 0.22.0 of cpp-httplib contains a patch that addresses this vulnerability.
If an immediate update is not possible, implement checks in your application to limit the number of HTTP headers sent in requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
