Bug 2364271 (CVE-2025-46728) - CVE-2025-46728 cpp-httplib: cpp-httplib Chunked Request Memory Exhaustion
Summary: CVE-2025-46728 cpp-httplib: cpp-httplib Chunked Request Memory Exhaustion
Keywords:
Status: NEW
Alias: CVE-2025-46728
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2364280 2364281 2364283 2364284 2364282
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-06 02:01 UTC by OSIDB Bzimport
Modified: 2025-05-12 13:22 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-06 02:01:09 UTC
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.


Note You need to log in before you can comment on or make changes to this bug.