Read the docs
TI-2026-24422 Aliases CVE-2026-31870

cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header

Priority HIGH 66CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00516 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cpp-httplib (yhirose): 0.37.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yhirosecpp-httplibbefore 0.37.10.37.1Patch availableCNA
  • cpp-httplib Vendoryhirose Affected before 0.37.1 Fixed in 0.37.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*before 0.37.1Vulnerableyhirose
  • cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* Versions before 0.37.1 Vulnerable ·yhirose

Remediation

  • Fix · CNA cpp-httplib (yhirose) Fixed in 0.37.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31870

References

Exploit 1

  • TI-2026-33163 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVSS 3.1CRITICAL 9.9
  • TI-2026-18294 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVSS 4.0HIGH 8.7
  • TI-2026-17313 cpp-httplib has CRLF injection in http headers CVSS 4.0HIGH 7.7
  • TI-2026-33146 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVSS 3.1HIGH 7.5
  • TI-2026-22709 Uncontrolled resource consumption in yhirose cpp-httplib CVSS 3.1HIGH 7.5
  • TI-2025-33556 cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability CVSS 3.1HIGH 7.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences