PT-2025-29150 · Unknown+1 · Cpp-Httplib+1

Otavioolsilva · Published 2025-07-10 · Updated 2026-03-02 · CVE-2025-53628

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: cpp-httplib versions prior to 0.20.1

Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Versions prior to 0.20.1 do not have a limit for a unique line, which allows an attacker to allocate memory arbitrarily. This issue is fixed in version 0.20.1.

Recommendations: Update cpp-httplib to version 0.20.1 or later.

Exploit

Fix

Infinite Loop

Allocation of Resources Without Limits

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-835

CWE-770

CWE-444

Related Identifiers

BDU:2026-00101

CVE-2025-53628

ECHO-AFA3-F31F-8C19

GHSA-J6P8-779X-P5PW

GHSA-QJMQ-H3CC-QV6W

OPENSUSE-SU-2026:20295-1

SUSE-SU-2026:20600-1

Affected Products

Debian

Cpp-Httplib

References · 23

• 🔥 https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53628.json · Exploit
• https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e · Patch
• https://bdu.fstec.ru/vul/2026-00101 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-53628 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53628 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-53628 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53628 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20295-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53628 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53628 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20600-1 · Vendor Advisory
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w · Note
• https://twitter.com/CVEnew/status/1943668193714966772 · Twitter Post