CVE-2025-53629: Cpp-httplib DoS Vulnerability

CVE-2025-53629 Overview

CVE-2025-53629 affects cpp-httplib, a popular C++11 single-file header-only cross-platform HTTP/HTTPS library maintained by yhirose. The vulnerability allows unauthenticated remote attackers to trigger arbitrary memory allocation on the server by sending HTTP requests with the Transfer-Encoding: chunked header. Sustained exploitation can exhaust server memory and cause denial of service. The flaw is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. It is related to CVE-2025-53628 and fixed in version 0.23.0.

Critical Impact
Remote unauthenticated attackers can exhaust server memory through crafted chunked HTTP requests, resulting in service unavailability for any application embedding vulnerable cpp-httplib versions.

Affected Products

yhirose cpp-httplib versions prior to 0.23.0
Applications and services embedding cpp-httplib as an HTTP server component
Cross-platform deployments on Windows, macOS, and Linux using the affected library

Discovery Timeline

2025-07-10 - CVE-2025-53629 published to NVD
2025-08-06 - Last updated in NVD database

Technical Details for CVE-2025-53629

Vulnerability Analysis

The vulnerability resides in how cpp-httplib processes incoming HTTP requests that declare Transfer-Encoding: chunked in their headers. When a client streams a chunked request body, the server reads chunk size declarations and allocates buffers to hold the incoming data. The implementation prior to 0.23.0 does not enforce an upper bound on the cumulative memory committed during chunk parsing. An attacker can advertise large chunk sizes or stream many chunks, causing the server to allocate memory proportional to attacker-controlled values.

Because the request can be issued without authentication and over a single network connection, a small number of malicious clients can drive memory consumption to the point of process termination or host instability. The vulnerability falls under denial of service through resource exhaustion.

Root Cause

The root cause is missing input validation and missing resource limits on chunked transfer decoding. The library trusts the chunk-size fields supplied by the client and grows internal buffers accordingly. No configurable ceiling existed to cap total request body size or per-chunk allocation before the fix shipped in 0.23.0.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to any endpoint exposed by an application linking cpp-httplib. The request includes Transfer-Encoding: chunked along with chunk-size headers that force the server to reserve large memory regions. Repeating this pattern across connections multiplies the impact.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-qjmq-h3cc-qv6w and the related advisory GHSA-j6p8-779x-p5pw for vendor technical details.

Detection Methods for CVE-2025-53629

Indicators of Compromise

HTTP requests carrying Transfer-Encoding: chunked headers paired with unusually large chunk-size declarations
Sudden, sustained growth in resident memory of processes that embed cpp-httplib
Repeated client connections from the same source issuing chunked POST or PUT requests with abnormal body framing
Application crashes or out-of-memory (OOM) kill events on hosts running cpp-httplib-based services

Detection Strategies

Inspect HTTP access logs and reverse-proxy logs for chunked requests with anomalous size or count patterns
Monitor process memory metrics for services that depend on cpp-httplib and alert on rapid allocation spikes
Deploy a WAF or reverse proxy rule that flags chunked requests exceeding a defined body-size threshold

Monitoring Recommendations

Track per-process RSS (Resident Set Size) and OOM-killer events on hosts running affected services
Forward HTTP and system telemetry to a centralized analytics platform to correlate request anomalies with resource consumption
Establish baselines for chunked transfer usage so deviations surface quickly

How to Mitigate CVE-2025-53629

Immediate Actions Required

Upgrade cpp-httplib to version 0.23.0 or later in all dependent applications and rebuild affected binaries
Inventory internal services for embedded copies of the header-only library, since static linkage hides the dependency from package managers
Place vulnerable services behind a reverse proxy or WAF that enforces request body size limits until patching completes

Patch Information

The fix is available in cpp-httplib 0.23.0. The vendor commit 17ba303889b8d4d719be3879a70639ab653efb99 introduces the memory-allocation safeguards. Refer to the GitHub Security Advisory GHSA-qjmq-h3cc-qv6w for full remediation guidance.

Workarounds

Configure an upstream reverse proxy (nginx, HAProxy, Envoy) to cap maximum request body size and reject oversized chunked payloads
Apply rate limiting and connection limits per source IP to reduce amplification potential
Disable or restrict endpoints that accept large request bodies until the upgrade is deployed

bash

# Example nginx reverse-proxy hardening in front of a cpp-httplib service
client_max_body_size 1m;
client_body_buffer_size 16k;
limit_conn_zone $binary_remote_addr zone=addr:10m;
limit_conn addr 10;
limit_req_zone $binary_remote_addr zone=req:10m rate=20r/s;
limit_req zone=req burst=40 nodelay;