Memory Allocation Vulnerability in cpp-httplib Package
Summary
UBUNTU-CVE-2025-53628: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.10.1+ds-1 – 0.9.9+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++11 single-file header-only library designed for cross-platform HTTP/HTTPS communication. It provides a simple interface for developers to implement web server and client functionalities without the need for extensive dependencies. However, prior to version 0.20.1, cpp-httplib lacked a limit on unique line lengths, making it susceptible to memory allocation exploits.
Vulnerability Detail
The vulnerability identified as CVE-2025-53628 allows attackers to exploit the lack of a limit on unique line lengths in cpp-httplib versions prior to 0.20.1. This oversight can lead to arbitrary memory allocation, potentially enabling attackers to manipulate application behavior or crash the application. The vulnerability is related to CVE-2025-53629, indicating a broader issue within the library's handling of input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, developers can implement input validation to limit the length of lines processed by cpp-httplib, thereby mitigating the risk of memory allocation issues until an update can be applied.
Conclusion
The cpp-httplib package has a significant vulnerability that can lead to arbitrary memory allocation, posing risks to applications that utilize it. It is crucial for developers to update to version 0.20.1 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cpp-httplib →
FAQ
CVE-2025-53628 is a vulnerability in the cpp-httplib package that allows for arbitrary memory allocation due to the absence of a limit on unique line lengths.
Versions prior to 0.20.1 of cpp-httplib are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or unintended behavior due to arbitrary memory allocation.
Yes, the vulnerability is fixed in version 0.20.1 of cpp-httplib. Updating to this version will resolve the issue.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
