CVE-2026-45352: cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::readpayload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONGMAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONGMAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunkremaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpp-httplibto a version that resolves this vulnerability.Fixed in 0.43.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45352?
CVE-2026-45352 has a medium severity rating of 5.3.
How does CVE-2026-45352 affect the cpp-httplib library?
CVE-2026-45352 allows for unbounded memory allocation and potential process crashes due to negative chunk-size in chunked Transfer-Encoding.
What is the impact of CVE-2026-45352 on applications using cpp-httplib?
Applications utilizing cpp-httplib may experience Denial of Service due to the vulnerability introduced by improper parsing of chunk sizes.
How do I fix CVE-2026-45352?
To fix CVE-2026-45352, upgrade to cpp-httplib version 0.43.4 or later to eliminate the vulnerability.
What types of attacks can CVE-2026-45352 enable?
CVE-2026-45352 can enable Denial of Service attacks through unbounded memory allocation leading to application crashes.