Memory Exhaustion Vulnerability in cpp-httplib: Critical Update Required
Summary
CVE-2025-53629: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib across 2 version ranges.
< 17ba303889b8d4d719be3879a70639ab653efb99
< ecfd84c1712b1bfe92107e37843f97ecec537da9
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library that simplifies the process of handling HTTP requests and responses. It is widely used for developing web applications due to its lightweight nature and ease of integration. However, prior to version 0.23.0, cpp-httplib had a critical vulnerability that allowed incoming requests with 'Transfer-Encoding: chunked' to allocate memory arbitrarily, potentially leading to server memory exhaustion.
Vulnerability Detail
The vulnerability arises from the handling of HTTP requests with 'Transfer-Encoding: chunked' headers, which can cause the server to allocate memory without bounds. This can lead to a denial of service (DoS) situation where the server runs out of memory, affecting its availability and performance. This issue is particularly concerning for applications that handle a large number of requests or operate in environments with limited resources. The vulnerability is related to CVE-2025-53628.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement request validation to reject any requests that use 'Transfer-Encoding: chunked'. This can be done by checking the headers of incoming requests and responding with an error if the 'Transfer-Encoding' header is present and set to 'chunked'.
Conclusion
In summary, the cpp-httplib package has a critical vulnerability that can lead to memory exhaustion due to improper handling of 'Transfer-Encoding: chunked' requests. It is essential to update to version 0.23.0 or later to mitigate this risk. Implementing request validation can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for cpp-httplib →
FAQ
The vulnerability can lead to memory exhaustion on the server, resulting in denial of service and making the application unavailable to users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Yes, the vulnerability has been fixed in version 0.23.0 of cpp-httplib. It is recommended to update to this version or later.
If an immediate update is not possible, implement request validation to reject 'Transfer-Encoding: chunked' requests as a temporary workaround.
You can find more information about cpp-httplib on its official GitHub repository or documentation pages.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
