PT-2026-44975 · Unknown · Cpp-Httplib

Oleksiioleksenko · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-45352

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.43.4

Description A flaw exists in the way the library handles chunked Transfer-Encoding. The read payload() function in httplib.h uses std::strtoul() to parse the chunk-size field. Because std::strtoul() accepts leading minus signs and performs unsigned wrap-around, negative values (except for -1) are converted into very large unsigned integers. This leads to unbounded memory allocation and causes the process to crash.

Recommendations Update to version 0.43.4.

Fix

DoS

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-1285

CWE-770

CWE-20

Related Identifiers

CVE-2026-45352

Affected Products

Cpp-Httplib

References · 4

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45352 · Security Note
• https://t.me/CVEtracker/55299 · Telegram Post
• https://twitter.com/CVEnew/status/2060470655120777386 · Twitter Post