CVE-2026-28435 Details
Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.
A vulnerability in cpp-httplib prior to version 0.35.0 allows for a payload size limit bypass in the server's handling of streaming content that is gzip-encoded. The library does not properly enforce the maximum payload length on decompressed request bodies when using the ContentReader feature. As a result, a small compressed payload can expand significantly after decompression, exceeding the configured payload limit and potentially leading to denial-of-service conditions by exhausting CPU and memory resources. This issue is particularly problematic in environments with high concurrency or limited resources, where the increased resource consumption can cause significant disruptions.
Users can update to cpp-httplib version 0.35.0 or later, where this vulnerability has been fixed. If an immediate update is not possible, consider disabling request-body decompression for endpoints that use ContentReader, or manually enforcing a decompressed-size limit in the application callback.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yhirose/cpp-httplib/commit/c99d7472b5cf4869d3897b9afc9792063a3d15a8 | [email protected] | Patch |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yhirose cpp-httplib | < 0.35.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 4, 2026 | New CVE Received | [email protected] |