CVE-2026-45352: cpp-httplib Negative Chunk Size Denial of Service

Technical summary

The vulnerability exists in the ChunkedDecoder::read_payload function within httplib.h. The code uses std::strtoul() to parse the chunk-size field from HTTP chunked transfer encoding without proper validation of negative values. Per C standard §7.22.1.4, strtoul silently interprets a leading minus sign and performs unsigned integer wrap-around. For example, strtoul("-2", ..., 16) returns 0xFFFFFFFFFFFFFFFE (ULONG_MAX − 1). While the library attempts to guard against the result ULONG_MAX (produced by "-1"), it fails to reject other negative values. The resulting near-maximum value is stored in chunk_remaining, which controls how many bytes the read loop attempts to consume from the network socket. This causes unbounded memory allocation and eventual process termination.

Business impact

Availability is the primary concern. An attacker can remotely trigger a denial of service by sending a malicious HTTP request, crashing any application or service built on cpp-httplib. This affects web services, APIs, embedded HTTP servers, and microservices relying on this library. The impact depends on deployment: a crash in a single-threaded handler affects one connection, but in thread-pool or async deployments, repeated attacks could exhaust server resources or trigger cascading failures. No data breach or integrity issue results, but service disruption can be significant.

Affected systems

cpp-httplib versions prior to 0.43.4 are affected. The library is used in a wide range of applications: embedded web servers, REST API servers, microservices, IoT devices with HTTP interfaces, and cross-platform applications. Any service or application linking against vulnerable versions of the library is at risk. Users should verify their cpp-httplib version and check whether their deployment model (single-threaded, multi-threaded, or async) increases exposure to repeated attack attempts.

Exploitability

Exploitability is straightforward. An attacker needs only network access to the affected HTTP server and the ability to send a crafted HTTP request with a negative chunk size in the Transfer-Encoding: chunked header. No authentication, user interaction, or special conditions are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects this: network-accessible, low complexity, no privileges or user interaction needed. However, actual impact depends on how the application handles crashes—whether it auto-restarts, whether the attacker must repeat the attack, and whether other mitigations (e.g., request size limits, timeouts) are in place.

Remediation

Update cpp-httplib to version 0.43.4 or later. This version includes a fix that properly validates chunk-size values and rejects negative or otherwise invalid inputs before they can trigger memory allocation issues. Patches should be applied across all systems and deployments using the library, including embedded instances and vendored copies. No workarounds are documented; patching is the primary mitigation.

Patch guidance

Upgrade cpp-httplib to 0.43.4 or newer. If you use cpp-httplib as a vendored header file in your project, replace the existing httplib.h with the fixed version. If you use it as a package dependency (via package manager or build system), update your dependency declaration and rebuild. Verify the fix by confirming the ChunkedDecoder::read_payload function now properly rejects negative chunk-size values. Test updated services in a staging environment before deploying to production. Review your deployment model to ensure auto-restart mechanisms are active, reducing the window for repeated denial-of-service attacks.

Detection guidance

Monitor for HTTP requests with unusual or malformed chunk-size headers, particularly those containing negative values or leading minus signs in the Transfer-Encoding: chunked field. Check application and system logs for unexpected crashes or out-of-memory errors correlated with HTTP traffic spikes. Network-based detection can inspect raw HTTP headers for invalid chunk-size syntax before traffic reaches the application. Host-based signals include sudden process termination, memory allocation failures, and core dumps. Correlate crashes across multiple instances to identify coordinated attack patterns. If cpp-httplib is used, consider enabling heap profiling or memory sanitizers during testing to catch unbounded allocation issues early.

Why prioritize this

Although the CVSS score is medium (5.3), this vulnerability merits prompt attention because: (1) it is remotely exploitable with no preconditions, (2) the fix is stable and available (0.43.4), (3) denial-of-service impact can disrupt business operations, and (4) exploitation requires minimal attacker sophistication. Organizations running cpp-httplib-based services should prioritize patching to restore service stability and prevent potential abuse. The lack of complexity and broad accessibility of the HTTP protocol make this a practical risk in internet-facing or internal-network deployments.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects: (1) network accessibility with low attack complexity and no privilege or user interaction requirements, yielding a high exploitability base; (2) availability impact (process crash) as the sole consequence, with no confidentiality or integrity loss; (3) no scope elevation—the impact is confined to the affected service. The score is not higher because the attack does not compromise data, escalate privileges, or affect other systems directly. However, the practical risk may be perceived as higher in critical infrastructure or high-availability environments where service disruption is costly.

Frequently asked questions