Critical Memory Allocation Vulnerability in cpp-httplib: Uncontrolled Memory Allocation via Chunked Requests
Summary
DEBIAN-CVE-2025-46728: cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.26.0+ds-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for creating HTTP/HTTPS server and client applications. It is lightweight and easy to integrate, making it popular among developers for building web services. However, prior to version 0.20.1, cpp-httplib had a significant vulnerability that allowed attackers to exploit its handling of incoming request bodies, particularly when using 'Transfer-Encoding: chunked' or when the 'Content-Length' header was absent.
Vulnerability Detail
The vulnerability arises from cpp-httplib's failure to enforce size limits on incoming request bodies. This can lead to uncontrolled memory allocation when a remote attacker sends a chunked request without the required terminating zero-length chunk. The consequences of this vulnerability include potential exhaustion of system memory, which can cause the server to crash or become unresponsive. The issue has been addressed in version 0.20.1, which implements strict limits during the parsing of incoming requests.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, a short-term workaround is to deploy a reverse proxy, such as Nginx or HAProxy, in front of your cpp-httplib application. Configure the proxy to enforce maximum request body size limits. For example, in Nginx, you can add the following configuration: 'client_max_body_size 1M;' to limit the request body size to 1 megabyte.
Conclusion
In summary, the cpp-httplib library has a critical vulnerability that can lead to uncontrolled memory allocation and server instability. It is crucial to update to version 0.20.1 or later to mitigate this risk. If immediate updates are not possible, implementing a reverse proxy can serve as a temporary workaround.
See every vulnerability recorded for cpp-httplib →
FAQ
cpp-httplib is a C++ header-only library used for building HTTP/HTTPS server and client applications.
All versions prior to 0.20.1 are affected by this vulnerability.
If your application is vulnerable, it may experience uncontrolled memory allocation, leading to server crashes or unresponsiveness.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If you cannot update immediately, deploy a reverse proxy like Nginx or HAProxy to enforce maximum request body size limits as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
