Memory Exhaustion Vulnerability in cpp-httplib: Critical Security Flaw
Summary
DEBIAN-CVE-2025-53629: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.26.0+ds-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library that simplifies the process of making HTTP requests and handling responses. It is widely used for its ease of integration and lightweight nature. However, prior to version 0.23.0, it was found to be vulnerable to a memory exhaustion issue when handling incoming requests with the 'Transfer-Encoding: chunked' header, which can lead to significant performance degradation or service outages.
Vulnerability Detail
The vulnerability, identified as CVE-2025-53629, arises from the way cpp-httplib processes incoming HTTP requests. Specifically, when the 'Transfer-Encoding: chunked' header is used, the library can allocate memory arbitrarily, potentially leading to memory exhaustion on the server. This can result in denial of service, where legitimate requests cannot be processed due to lack of available memory. The issue is particularly concerning for applications that handle a high volume of requests, as it can be exploited to disrupt service availability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on incoming requests to mitigate the impact of potential memory exhaustion. This can help control the number of concurrent requests being processed and reduce the likelihood of service disruption.
Conclusion
In summary, the vulnerability CVE-2025-53629 in cpp-httplib poses a significant risk of memory exhaustion due to improper handling of HTTP requests. It is crucial to update to version 0.23.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cpp-httplib →
FAQ
CVE-2025-53629 is a vulnerability in cpp-httplib that allows for memory exhaustion due to improper handling of 'Transfer-Encoding: chunked' requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main consequence is denial of service, where legitimate requests cannot be processed due to memory exhaustion, potentially leading to service outages.
Yes, the vulnerability has been fixed in version 0.23.0 of cpp-httplib. Updating to this version will resolve the issue.
If you cannot update immediately, consider implementing rate limiting on incoming requests to mitigate the risk of memory exhaustion.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
