CVE-2026-22776: cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payloadmaxlength against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22776?
CVE-2026-22776 is classified as a high-severity Denial of Service (DoS) vulnerability.
How do I fix CVE-2026-22776?
To fix CVE-2026-22776, upgrade to cpp-httplib version 0.30.1 or later.
What causes CVE-2026-22776?
CVE-2026-22776 is caused by the unsafe handling of compressed HTTP request bodies, specifically zip bombs.
Which versions of cpp-httplib are affected by CVE-2026-22776?
CVE-2026-22776 affects all versions of cpp-httplib prior to 0.30.1.
What impact does CVE-2026-22776 have on applications?
CVE-2026-22776 can lead to a Denial of Service (DoS), potentially causing applications to become unresponsive.