Memory Allocation Vulnerability in cpp-httplib Package
Summary
DEBIAN-CVE-2025-53628: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.26.0+ds-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library that simplifies the process of making HTTP requests and handling responses. It is widely used for its ease of integration and lightweight design. However, prior to version 0.20.1, cpp-httplib lacked a limit for unique line allocations, making it susceptible to memory exploitation attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-53628 arises from cpp-httplib's failure to impose restrictions on the allocation of memory for unique lines. This oversight allows an attacker to exploit the library, potentially leading to arbitrary memory allocation. Such exploitation could result in application crashes or unauthorized access to sensitive data. This vulnerability is closely related to CVE-2025-53629, indicating a broader issue within the library's memory management.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to limit the size of incoming data and prevent excessive memory allocation. This can be done by checking the length of incoming requests and rejecting those that exceed a predefined threshold.
Conclusion
In summary, the cpp-httplib package has a significant vulnerability (CVE-2025-53628) that allows for arbitrary memory allocation, posing risks to applications using it. Updating to version 0.20.1 or later is crucial to mitigate these risks. For those unable to update immediately, implementing input validation can serve as a temporary measure.
See every vulnerability recorded for cpp-httplib →
FAQ
CVE-2025-53628 is a vulnerability in the cpp-httplib package that allows for arbitrary memory allocation due to the lack of limits on unique line sizes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include application crashes, unauthorized access to sensitive data, and potential exploitation by attackers to manipulate memory.
Yes, the vulnerability is fixed in version 0.20.1 of cpp-httplib. It is recommended to update to this version or later.
If an immediate update is not possible, implement input validation as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
