PT-2025-26976 · Unknown+1 · Cpp-Httplib+1

Whereisoops · Published 2025-06-24 · Updated 2025-12-06 · CVE-2025-52887

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.22.0 cpp-httplib version 0.21.0

Description cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. A resource management issue exists in version 0.21.0 due to the library not limiting the number of HTTP headers it processes. This can lead to uncontrolled resource consumption, potentially exhausting system memory and causing a server crash or unresponsiveness when many HTTP header fields are passed in. The memory associated with the headers is not released when the connection is disconnected.

Recommendations Upgrade to cpp-httplib version 0.22.0 or later.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2025-07737

CVE-2025-52887

GHSA-XJHG-GF59-P92H

OESA-2025-1721

OESA-2025-1722

OESA-2025-1723

OESA-2025-1724

OESA-2025-1829

Affected Products

Debian

Cpp-Httplib

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52887.json · Exploit
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h · Vendor Advisory
• https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-52887 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1721 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-52887 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-52887 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-52887 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1829 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1724 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52887 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07737 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-52887 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1722 · Vendor Advisory