CVE-2026-29076: cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29076?
CVE-2026-29076 is classified as a Denial of Service vulnerability due to a stack overflow.
How do I fix CVE-2026-29076?
To fix CVE-2026-29076, upgrade cpp-httplib to version 0.37.0 or later.
What versions are affected by CVE-2026-29076?
CVE-2026-29076 affects cpp-httplib versions prior to 0.37.0.
What is the cause of CVE-2026-29076?
CVE-2026-29076 is caused by the misuse of std::regex for parsing multipart filename values.
Can CVE-2026-29076 be exploited remotely?
Yes, CVE-2026-29076 can be exploited remotely to cause a Denial of Service.