CVE-2026-45352 Details

A denial-of-service vulnerability has been identified in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library, in versions prior to 0.43.4. The issue arises in the ChunkedDecoder::read_payload function, where negative chunk-sizes in chunked Transfer-Encoding are improperly handled. The function uses std::strtoul() to parse chunk sizes, and due to the C standard's allowance for negative values to be interpreted as large unsigned numbers, a chunk-size of '-2' is accepted and treated as nearly 2^64 bytes. This misinterpretation leads to unbounded memory allocation, causing the process to crash. The vulnerability is exacerbated by the library's only validation check, which rejects only the maximum unsigned value, allowing other negative values to pass through and be exploited.

Users can upgrade to cpp-httplib version 0.43.4 or later, where this vulnerability has been fixed.