See the release notes of intermediate versions:
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2
This fixes numerous vulnerabilities:
- CVE-2026-21428:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers``
function does not check for CR & LF characters in user supplied
headers, allowing untrusted header value to escape header lines. This
vulnerability allows attackers to add extra headers, modify request
body unexpectedly & trigger an SSRF attack. When combined with a
server that supports http1.1 pipelining (springboot, python twisted
etc), this can be used for server side request forgery (SSRF). Version
0.30.0 fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-21428
- CVE-2026-22776:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS)
vulnerability exists in cpp-httplib due to the unsafe handling of
compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The
library validates the payload_max_length against the compressed data
size received from the network, but does not limit the size of the
decompressed data stored in memory.
https://www.cve.org/CVERecord?id=CVE-2026-22776
- CVE-2026-28434:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a
C++ exception and the application has not registered a custom
exception handler via set_exception_handler(), the library catches the
exception and writes its message directly into the HTTP response as a
header named EXCEPTION_WHAT. This header is sent to whoever made the
request, with no authentication check and no special configuration
required to trigger it. The behavior is on by default. A developer who
does not know to opt in to set_exception_handler() will ship a server
that leaks internal exception messages to any client. This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28434
- CVE-2026-28435:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not
enforce Server::set_payload_max_length() on the decompressed request
body when using HandlerWithContentReader (streaming ContentReader)
with Content-Encoding: gzip (or other supported encodings). A small
compressed payload can expand beyond the configured payload limit and
be processed by the application, enabling a payload size limit bypass
and potential denial of service (CPU/memory exhaustion). This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28435
- CVE-2026-29076:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses
std::regex (libstdc++) to parse RFC 5987 encoded filename* values in
multipart Content-Disposition headers. The regex engine in libstdc++
implements backtracking via deep recursion, consuming one stack frame
per input character. An attacker can send a single HTTP POST request
with a crafted filename* parameter that causes uncontrolled stack
growth, resulting in a stack overflow (SIGSEGV) that crashes the
server process. This issue has been patched in version 0.37.0.
https://www.cve.org/CVERecord?id=CVE-2026-29076
- CVE-2026-31870:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses
the streaming API (httplib::stream::Get, httplib::stream::Post, etc.),
the library calls std::stoull() directly on the Content-Length header
value received from the server with no input validation and no
exception handling. std::stoull throws std::invalid_argument for non-
numeric strings and std::out_of_range for values exceeding ULLONG_MAX.
Since nothing catches these exceptions, the C++ runtime calls
std::terminate(), which kills the process with SIGABRT. Any server the
client connects to — including servers reached via HTTP redirects,
third-party APIs, or man-in-the-middle positions can crash the client
application with a single HTTP response. No authentication is
required. No interaction from the end user is required. The crash is
deterministic and immediate. This vulnerability is fixed in 0.37.1.
https://www.cve.org/CVERecord?id=CVE-2026-31870
- CVE-2026-32627:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is
configured with a proxy and set_follow_location(true), any HTTPS
redirect it follows will have TLS certificate and hostname
verification silently disabled on the new connection. The client will
accept any certificate presented by the redirect target — expired,
self-signed, or forged — without raising an error or notifying the
application. A network attacker in a position to return a redirect
response can fully intercept the follow-up HTTPS connection, including
any credentials or session tokens in flight. This vulnerability is
fixed in 0.37.2.
https://www.cve.org/CVERecord?id=CVE-2026-32627
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit [1] removed the stale cpp-httplib patched but the
IGNORE_CVES entry wasn't removed.
[1] 8988278241 package/cpp-httplib: remove stale patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fix the following vulnerability:
- CVE-2025-46728
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.
Prior to version 0.20.1, the library fails to enforce configured size
limits on incoming request bodies when `Transfer-Encoding: chunked` is
used or when no `Content-Length` header is provided. A remote attacker
can send a chunked request without the terminating zero-length chunk,
causing uncontrolled memory allocation on the server. This leads to
potential exhaustion of system memory and results in a server crash or
unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits
during parsing. If the limit is exceeded at any point during reading,
the connection is terminated immediately. A short-term workaround
through a Reverse Proxy is available. If updating the library
immediately is not feasible, deploy a reverse proxy (e.g., Nginx,
HAProxy) in front of the `cpp-httplib` application. Configure the
proxy to enforce maximum request body size limits, thereby stopping
excessively large requests before they reach the vulnerable library
code.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-46728
- 7b752106ac
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(cherry picked from commit aea7c89396)
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fix the following vulnerability:
- CVE-2025-46728
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.
Prior to version 0.20.1, the library fails to enforce configured size
limits on incoming request bodies when `Transfer-Encoding: chunked` is
used or when no `Content-Length` header is provided. A remote attacker
can send a chunked request without the terminating zero-length chunk,
causing uncontrolled memory allocation on the server. This leads to
potential exhaustion of system memory and results in a server crash or
unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits
during parsing. If the limit is exceeded at any point during reading,
the connection is terminated immediately. A short-term workaround
through a Reverse Proxy is available. If updating the library
immediately is not feasible, deploy a reverse proxy (e.g., Nginx,
HAProxy) in front of the `cpp-httplib` application. Configure the
proxy to enforce maximum request body size limits, thereby stopping
excessively large requests before they reach the vulnerable library
code.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-46728
- 7b752106ac
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
