CVE-2026-28435: Yhirose Cpp-httplib DoS Vulnerability

CVE-2026-28435 Overview

CVE-2026-28435 is a Resource Exhaustion vulnerability affecting cpp-httplib, a popular C++11 single-file header-only cross-platform HTTP/HTTPS library. The vulnerability exists in versions prior to 0.35.0 where the library fails to properly enforce the Server::set_payload_max_length() limit on decompressed request bodies when using HandlerWithContentReader (streaming ContentReader) with compressed content encodings such as gzip.

This flaw allows attackers to send small compressed payloads that expand well beyond the configured payload limit during decompression, effectively bypassing size restrictions and potentially causing denial of service through CPU and memory exhaustion.

Critical Impact

A small malicious compressed payload can expand beyond configured limits, enabling payload size limit bypass and denial of service (CPU/memory exhaustion) on servers using cpp-httplib with streaming content readers and compression support.

Affected Products

• yhirose cpp-httplib versions prior to 0.35.0
• Applications using HandlerWithContentReader with compression support enabled
• HTTP/HTTPS servers built with cpp-httplib that rely on set_payload_max_length() for request size limiting

Discovery Timeline

• 2026-03-04 - CVE-2026-28435 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28435

Vulnerability Analysis

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The core issue lies in how cpp-httplib handles content decompression when processing HTTP requests through its streaming content reader interface.

When a server is configured with Server::set_payload_max_length() to limit incoming request body sizes, this restriction is properly enforced on raw compressed payloads. However, when the HandlerWithContentReader streaming interface is used in conjunction with Content-Encoding: gzip (or other supported compression encodings), the library fails to validate the decompressed size against the configured limit.

This creates a classic "decompression bomb" or "zip bomb" attack vector where an attacker can craft a highly compressed payload that expands to a size far exceeding the intended server limits. The impact manifests as memory exhaustion when the decompressed data is buffered, or CPU exhaustion during the decompression process itself.

Root Cause

The root cause is a missing size validation check in the decompression path when using streaming content readers. The set_payload_max_length() configuration was only being applied to the compressed payload size at the network layer, not to the resulting decompressed content being processed by the application. This architectural oversight allows the size limit to be completely bypassed through the use of compression.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a small, highly compressed gzip payload (or using other supported encodings)
2. Sending an HTTP request to a vulnerable cpp-httplib server with the Content-Encoding: gzip header
3. The compressed payload passes the set_payload_max_length() check at the network layer
4. When the server uses HandlerWithContentReader to process the request, decompression occurs without size validation
5. The decompressed payload expands far beyond configured limits, consuming excessive memory and CPU resources

The vulnerability is particularly dangerous because compression ratios can be extreme for specially crafted data, allowing payloads that expand by factors of 100x or more. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-28435

Indicators of Compromise

• Unusually high memory consumption on servers using cpp-httplib
• CPU spikes correlated with incoming HTTP requests containing Content-Encoding: gzip headers
• Server crashes or out-of-memory errors during request processing
• Small incoming request payloads triggering disproportionate resource usage

Detection Strategies

• Monitor for HTTP requests with compression headers (Content-Encoding: gzip, Content-Encoding: deflate) that have unusually small body sizes
• Implement application-level logging to track decompressed payload sizes versus compressed sizes
• Deploy network intrusion detection rules to identify potential decompression bomb patterns
• Audit application dependencies to identify cpp-httplib versions prior to 0.35.0

Monitoring Recommendations

• Set up alerts for memory and CPU usage anomalies on servers running cpp-httplib-based applications
• Monitor HTTP access logs for requests with compression encodings targeting streaming endpoints
• Implement rate limiting on endpoints using HandlerWithContentReader with compression support
• Use Software Composition Analysis (SCA) tools to track cpp-httplib version across your codebase

How to Mitigate CVE-2026-28435

Immediate Actions Required

• Upgrade cpp-httplib to version 0.35.0 or later immediately
• Audit all applications using cpp-httplib to identify affected deployments
• If immediate upgrade is not possible, consider temporarily disabling compression support on affected endpoints
• Review and implement network-level rate limiting to reduce exposure

Patch Information

The vulnerability has been fixed in cpp-httplib version 0.35.0. The fix ensures that Server::set_payload_max_length() is properly enforced on decompressed content when using streaming content readers with compressed encodings.

Review the GitHub Commit Details for the specific code changes implementing this fix.

Workarounds

• Disable compression support on endpoints using HandlerWithContentReader until the library can be upgraded
• Implement application-level decompressed size validation before processing streamed content
• Deploy a reverse proxy or WAF in front of cpp-httplib servers to filter potentially malicious compressed payloads
• Use network-level request body size limits as an additional layer of defense

# Example: Update cpp-httplib in your project
# If using vcpkg package manager
vcpkg upgrade cpp-httplib

# If using the header file directly, download the patched version
curl -o httplib.h https://raw.githubusercontent.com/yhirose/cpp-httplib/v0.35.0/httplib.h

# Verify the version in your codebase
grep -r "CPPHTTPLIB_VERSION" httplib.h