CVE-2025-53629 cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability

What is CVE-2025-53629?

CVE-2025-53629 is a high-severity denial of service vulnerability in yhirose cpp-httplib, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is related to CVE-2025-53628.

Weakness: CWE-770

Which versions are affected by CVE-2025-53629?

It affects 1 product.

Products include Yhirose Cpp-Httplib.

How do I fix CVE-2025-53629?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-53629 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53629 exists.

Other vulnerabilities in yhirose cpp-httplib

• CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) Critical 10.0
• CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection Critical 9.9
• CVE-2026-46527 Null dereference in cpp-httplib High 8.7
• CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy High 8.7
• CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb High 8.7

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as DEBIAN-CVE-2025-53629, ECHO-39ee-6c8b-c400, OESA-2025-1839, OESA-2025-1840, OESA-2025-1841, OESA-2025-1842 and 2 more.