CVE-2026-45352

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.

• CWE-20
• CWE-770
• CWE-1285

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8Exploit, Vendor Advisory
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8Exploit, Vendor Advisory

Published

May 29, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45347Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-45348pyLoad is a free and open-source download manager written in…8.7
• CVE-2026-45349Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-4535A vulnerability has been found in Tenda FH451 1.0.0.9. This …8.8
• CVE-2026-45350Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-45351Open WebUI is a self-hosted artificial intelligence platform…6.5
• CVE-2026-45353electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.8
• CVE-2026-45357LiquidJS is a Shopify/GitHub Pages compatible template engin…7.5
• CVE-2026-45358ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-45359ImageMagick is free and open-source software used for editin…5.7
• CVE-2026-4536A vulnerability was found in Acrel Environmental Monitoring …7.3
• CVE-2026-45360Apache Airflow's scheduler-side deadline-reference decoder (…7.3