CVE-2025-46728

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.

• CWE-400

• https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8ePatch
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-px83-72rx-v57cExploit, Vendor Advisory

Published

May 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46722vLLM is an inference and serving engine for large language m…7.3
• CVE-2025-46723OpenVM is a performant and modular zkVM framework built for …7.8
• CVE-2025-46724Langroid is a Python framework to build large language model…9.8
• CVE-2025-46725Langroid is a Python framework to build large language model…9.8
• CVE-2025-46726Langroid is a framework for building large-language-model-po…9.1
• CVE-2025-46727Rack is a modular Ruby web server interface. Prior to versio…7.5
• CVE-2025-46729julmud/phpDVDProfiler is an adoption of the defunct phpDVDPr…2.1
• CVE-2025-4673Proxy-Authorization and Proxy-Authenticate headers persisted…6.8
• CVE-2025-46730MobSF is a mobile application security testing tool used. Ty…6.5
• CVE-2025-46731Craft is a content management system. Versions of Craft CMS …7.2
• CVE-2025-46732OpenCTI is an open source platform for managing cyber threat…5.4
• CVE-2025-46733OP-TEE is a Trusted Execution Environment (TEE) designed as …7.9