{"kind": "product", "path": "vulns/ubuntu-25.10/cpp-httplib", "name": "cpp-httplib", "product": "cpp-httplib", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-45372", "noindex": false, "published": "2026-05-29T19:21:12.313Z", "modified": "2026-06-01T17:57:44.116Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "severity": "critical", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45372", "title": "cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \\r\\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m", "https://nvd.nist.gov/vuln/detail/CVE-2026-45372"], "fixes": ["0.18.7-1ubuntu0.25.10.2"], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-46527", "noindex": false, "published": "2026-05-29T19:18:26.615Z", "modified": "2026-06-01T13:52:30.508Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00327, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46527", "title": "cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g", "https://nvd.nist.gov/vuln/detail/CVE-2026-46527"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45352", "noindex": false, "published": "2026-05-29T19:14:08.065Z", "modified": "2026-06-02T01:52:12.106Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00327, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45352", "title": "cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul(\"-2\", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of \"-1\"), but any other negative value such as \"-2", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8", "https://nvd.nist.gov/vuln/detail/CVE-2026-45352"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-34441", "noindex": false, "published": "2026-03-31T21:21:33.197Z", "modified": "2026-04-01T15:53:07.782Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00196, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34441", "title": "cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.40.0, cpp-httplib is vulnerable to HTTP Request Smuggling. The server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connections, the unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request. An attacker can embed an arbitrary HTTP request inside the body of a GET request, which the server processes as a separate request. This issue has been patched in version 0.40.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-jv63-rm9j-6jwc", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.40.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-34441"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-33745", "noindex": false, "published": "2026-03-27T00:46:48.941Z", "modified": "2026-04-01T03:55:22.387Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00266, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33745", "title": "cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following cross-origin HTTP redirects (301/302/307/308). A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the `Authorization` header. Version 0.39.0 fixes the issue.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-6hrp-7fq9-3qv2", "https://nvd.nist.gov/vuln/detail/CVE-2026-33745"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-32627", "noindex": false, "published": "2026-03-13T20:48:14.442Z", "modified": "2026-03-16T15:41:05.578Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32627", "title": "cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulner", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g", "https://nvd.nist.gov/vuln/detail/CVE-2026-32627"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-31870", "noindex": false, "published": "2026-03-11T17:57:49.744Z", "modified": "2026-03-12T20:10:21.550Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31870", "title": "cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reac", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx", "https://nvd.nist.gov/vuln/detail/CVE-2026-31870"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-29076", "noindex": false, "published": "2026-03-07T16:08:56.048Z", "modified": "2026-03-09T18:25:58.815Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00639, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-29076", "title": "cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qq6v-r583-3h69", "https://github.com/yhirose/cpp-httplib/commit/de296af3eb5b0d5c116470e033db900e4812c5e6", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28435", "noindex": false, "published": "2026-03-04T19:36:33.418Z", "modified": "2026-03-04T20:39:46.131Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00435, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28435", "title": "Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp", "https://github.com/yhirose/cpp-httplib/commit/c99d7472b5cf4869d3897b9afc9792063a3d15a8", "https://nvd.nist.gov/vuln/detail/CVE-2026-28435"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28434", "noindex": false, "published": "2026-03-04T19:34:30.486Z", "modified": "2026-03-04T20:55:40.320Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28434", "title": "cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages ", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q", "https://github.com/yhirose/cpp-httplib/commit/defd907c7469c5c8281247b73bbd07be24c31164", "https://nvd.nist.gov/vuln/detail/CVE-2026-28434"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-22776", "noindex": false, "published": "2026-01-12T18:18:01.527Z", "modified": "2026-01-12T18:49:59.317Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00411, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-22776", "title": "cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h934-98h4-j43q", "https://github.com/yhirose/cpp-httplib/commit/2e2e47bab1ae6a853476eecbc4bf279dd1fef792", "https://nvd.nist.gov/vuln/detail/CVE-2026-22776"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-21428", "noindex": false, "published": "2026-01-01T17:54:43.959Z", "modified": "2026-01-02T18:50:20.380Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00404, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-21428", "title": "cpp-httplib has CRLF injection in http headers", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines.\nThis vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-wpc6-j37r-jcx7", "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-66577", "noindex": false, "published": "2025-12-05T18:20:25.852Z", "modified": "2025-12-05T18:29:10.535Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-66577", "title": "cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2", "https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff", "https://nvd.nist.gov/vuln/detail/CVE-2025-66577"], "fixes": ["0.18.7-1ubuntu0.25.10.1"], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-66570", "noindex": false, "published": "2025-12-05T18:18:02.928Z", "modified": "2025-12-05T18:40:09.318Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "critical", "epss": 0.00336, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-66570", "title": "cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the c", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xm2j-vfr9-mg9m", "https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff", "https://nvd.nist.gov/vuln/detail/CVE-2025-66570"], "fixes": ["0.18.7-1ubuntu0.25.10.1"], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-53629", "noindex": false, "published": "2025-07-10T19:46:01.872Z", "modified": "2025-07-10T20:19:21.578Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00594, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-53629", "title": "cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is related to CVE-2025-53628.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w", "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw", "https://github.com/yhirose/cpp-httplib/commit/17ba303889b8d4d719be3879a70639ab653efb99"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-53628", "noindex": false, "published": "2025-07-10T19:45:54.960Z", "modified": "2025-07-10T20:26:28.864Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00524, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-53628", "title": "cpp-httplib does not limit the length of a line", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw", "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w", "https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-52887", "noindex": false, "published": "2025-06-26T14:31:52.092Z", "modified": "2025-06-26T14:46:31.045Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0049, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-52887", "title": "cpp-httplib has unlimited number of http header fields, which causes memory leak", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h", "https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9", "https://nvd.nist.gov/vuln/detail/CVE-2025-52887"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-46728", "noindex": false, "published": "2025-05-06T00:45:25.130Z", "modified": "2025-05-06T02:43:44.757Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00663, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-46728", "title": "cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests", "description": "cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is t", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-px83-72rx-v57c", "https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e", "https://nvd.nist.gov/vuln/detail/CVE-2025-46728"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}]}], "total": 18, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-25.10/cpp-httplib", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-02T01:52:12.106Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}