CVE-2025-53629

cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is related to CVE-2025-53628.

Affected

yhirose · cpp-httplib

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.59% chance of exploitation in the next 30 days, 47th percentile

Published

2025-07-10

Proof-of-concept exploits (1)

• yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w

Security advisories

• yhirose/cpp-httplib/commit/17ba303889b8d4d719be3879a70639ab653efb99

References

• CVE Record
• NVD entry