PT-2026-2292 · Unknown · Cpp-Httplib

Hritik14 · Published 2026-01-12 · Updated 2026-03-26 · CVE-2026-22776

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.30.1

Description A potential denial of service (DoS) condition exists in cpp-httplib due to the way it handles compressed HTTP request bodies, specifically those using gzip or br compression. The library checks the payload max length against the compressed data size received, but does not limit the size of the decompressed data stored in memory. This can lead to excessive memory consumption and potentially cause a DoS.

Recommendations Update cpp-httplib to version 0.30.1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2026-22776

GHSA-H934-98H4-J43Q

OPENSUSE-SU-2026:10435-1

OPENSUSE-SU-2026:20733-1

SUSE-SU-2026:21599-1

Affected Products

Cpp-Httplib

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22776.json · Exploit
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h934-98h4-j43q · Vendor Advisory
• https://github.com/yhirose/cpp-httplib/commit/2e2e47bab1ae6a853476eecbc4bf279dd1fef792 · Patch
• https://cve.org/CVERecord?id=CVE-2026-22776 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10435-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-22776 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22776 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22776 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-22776 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22776 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22776 · Vendor Advisory
• https://twitter.com/CVEnew/status/2010788148595527762 · Twitter Post
• https://suse.com/security/cve/CVE-2026-28434 · Note
• https://suse.com/security/cve/CVE-2026-21428 · Note
• https://suse.com/security/cve/CVE-2026-28435 · Note