CVE-2025-52887 cpp-httplib has unlimited number of http header fields, which causes memory leak

What is CVE-2025-52887?

CVE-2025-52887 is a high-severity denial of service vulnerability in yhirose cpp-httplib, published on 26 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue.

Weakness: CWE-400

Which versions are affected by CVE-2025-52887?

It affects 1 product.

Products include Yhirose Cpp-Httplib.

How do I fix CVE-2025-52887?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-52887 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-52887 exists.

Other vulnerabilities in yhirose cpp-httplib

• CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) Critical 10.0
• CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection Critical 9.9
• CVE-2026-46527 Null dereference in cpp-httplib High 8.7
• CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy High 8.7
• CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xjhg-gf59-p92h, OESA-2025-1721, OESA-2025-1722, OESA-2025-1723, OESA-2025-1724, OESA-2025-1829 and 1 more.