Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

cpp-httplib — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in cpp-httplib, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities affecting the cpp-httplib C++ HTTP server library, categorized by weakness type and associated tags. It aggregates a comprehensive list of known issues including buffer overflows, memory corruption, and denial-of-service conditions that have been publicly disclosed or assigned Common Vulnerabilities and Exposures (CVE) identifiers. The scope of this collection covers vulnerability reports from the initial release of the library through the most recent patch cycles, ensuring that both legacy and contemporary security flaws are accessible for review. By consulting this resource, users can track specific advisories issued by the vendor to stay informed about critical fixes and mitigation strategies. Additionally, researchers and developers can gain a deeper understanding of common weakness classifications inherent to HTTP server implementations in C++. The archive also provides a detailed history of vulnerabilities associated with cpp-httplib, allowing teams to assess the security posture of their deployments and verify whether specific versions are susceptible to documented exploits. This centralized view facilitates rapid decision-making for patch management and risk assessment without requiring cross-referencing multiple external databases or disparate security feeds. Maintaining an accurate record of these defects helps organizations prioritize updates based on severity and relevance to their specific architecture.

Vendor: yhirose

CVE ID Title CVSS Severity Published
CVE-2026-54919 cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends CWE-295 7.4 High 2026-07-10
CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CWE-93 9.9 Critical 2026-05-29
CVE-2026-46527 cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash CWE-476 - - 2026-05-29
CVE-2026-45352 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CWE-20 5.3 Medium 2026-05-29
CVE-2026-34441 cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body CWE-444 4.8 Medium 2026-03-31
CVE-2026-33745 cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect CWE-200 7.4 High 2026-03-27
CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy CWE-295 8.7 High 2026-03-13
CVE-2026-31870 cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header CWE-248 7.5 High 2026-03-11
CVE-2026-29076 cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing CWE-674 5.9 Medium 2026-03-07
CVE-2026-28435 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib CWE-400 7.5 High 2026-03-04
CVE-2026-28434 cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header CWE-200 5.3 Medium 2026-03-04
CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CWE-409 7.5AI High AI 2026-01-12
CVE-2026-21428 cpp-httplib has CRLF injection in http headers CWE-93 9.1 - 2026-01-01
CVE-2025-66577 cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust CWE-117 5.3 Medium 2025-12-05
CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) CWE-290 10.0 Critical 2025-12-05
CVE-2025-53629 cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability CWE-770 7.5 High 2025-07-10
CVE-2025-53628 cpp-httplib does not limit the length of a line CWE-835 7.5AI High AI 2025-07-10
CVE-2025-52887 cpp-httplib has unlimited number of http header fields, which causes memory leak CWE-400 7.5 High 2025-06-26
CVE-2025-46728 cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests CWE-400 7.5 High 2025-05-06

All 19 known CVE vulnerabilities affecting cpp-httplib with full Chinese analysis, references, and POCs where available.