Memory Allocation Vulnerability in cpp-httplib: CVE-2025-53628
Summary
CVE-2025-53628: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib across 2 version ranges.
< 3af7f2c16147f3fbc6e4d717032daf505dc1652c
< 7b752106ac42bd5b907793950d9125a0972c8e8e
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library that simplifies the process of making HTTP requests and handling responses. It is designed for ease of use and portability, making it a popular choice among developers for integrating HTTP functionalities into C++ applications. However, prior to version 0.20.1, cpp-httplib lacked a limit on unique line allocations, exposing it to potential memory exploitation attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-53628 allows an attacker to exploit the absence of a limit on unique line allocations in cpp-httplib versions before 0.20.1. This could lead to arbitrary memory allocation, potentially resulting in application crashes or unauthorized access to sensitive data. The vulnerability is closely related to CVE-2025-53629, indicating a broader issue within the library's memory management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to limit the size of incoming requests or responses. This can help mitigate the risk of memory exploitation until the package is updated. Additionally, monitor your application for unusual memory usage patterns.
Conclusion
CVE-2025-53628 is a critical vulnerability in cpp-httplib that allows for arbitrary memory allocation, posing risks to application stability and security. Users are urged to update to version 0.20.1 or later to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for cpp-httplib →
FAQ
CVE-2025-53628 is a vulnerability in cpp-httplib that allows for arbitrary memory allocation due to the lack of limits on unique line allocations.
Versions of cpp-httplib prior to 0.20.1 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability could lead to application crashes or unauthorized access to sensitive data, posing a significant security risk.
Yes, the vulnerability has been patched in version 0.20.1 of cpp-httplib. It is recommended to update to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
