CVE-2025-46728 cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests
Remote attackers can exhaust server memory via unbounded chunked requests in cpp-httplib, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46728?
CVE-2025-46728 is a high-severity denial of service vulnerability in yhirose cpp-httplib, published on 6 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.
Weakness: CWE-400
Which versions are affected by CVE-2025-46728?
It affects 1 product.
Linux distribution packages (1)
cpp-httplib openSUSE:Tumbleweed | All versions | 0.20.1-1.1 |
Products include Cpp-Httplib Project Cpp-Httplib.
How do I fix CVE-2025-46728?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-46728 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46728 exists.
Other vulnerabilities in yhirose cpp-httplib
Sources
Also known as DEBIAN-CVE-2025-46728, ECHO-f24e-40e5-ba8e, GHSA-px83-72rx-v57c, OESA-2025-1610, OESA-2025-1611, OESA-2025-1612 and 3 more.