CVE-2025-53628 Details
Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.
A vulnerability in cpp-httplib, a cross-platform HTTP/HTTPS library for C++11, prior to version 0.22.0, allows for unbounded memory allocation through chunked transfer-encoding requests. This flaw can lead to memory exhaustion and cause the server to crash or become unresponsive. Although version 0.20.1 introduced a line length limit to prevent similar issues, the vulnerability persists in the latest version due to the way chunked requests can be exploited. Additionally, this vulnerability is related to CVE-2025-53629, which involves a similar memory allocation issue in chunked requests without a specified length.
Users are advised to update to cpp-httplib version 0.23.0, which addresses this vulnerability by enforcing a limit on the total length of chunked data that can be received in a single request.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e | [email protected] | Patch |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw | [email protected] | ExploitVendor Advisory |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yhirose cpp-httplib | < 0.20.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2025 | Initial Analysis | [email protected] |
| Jul 10, 2025 | CVE Modified | CISA-ADP |
| Jul 10, 2025 | New CVE Received | [email protected] |