CVE-2026-29076 Details

A denial-of-service vulnerability has been identified in cpp-httplib versions prior to 0.37.0. The issue arises from the library's use of std::regex in libstdc++ to parse RFC 5987 encoded filename values in multipart Content-Disposition headers. This regex implementation allows for backtracking through deep recursion, with each input character consuming a stack frame. An attacker can exploit this by sending an HTTP POST request with a specially crafted filename parameter, leading to uncontrolled stack growth and a stack overflow that crashes the server process. The vulnerability affects any endpoint that accepts multipart/form-data uploads.

Users can upgrade to cpp-httplib version 0.37.0 or later, where this vulnerability has been patched.