CVE-2026-31870: cpp-httplib DoS Vulnerability

CVE-2026-31870 Overview

A denial of service vulnerability exists in cpp-httplib, a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling.

The std::stoull function throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT.

Critical Impact

Any server the client connects to—including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions—can crash the client application with a single HTTP response. No authentication or user interaction is required, and the crash is deterministic and immediate.

Affected Products

• cpp-httplib versions prior to 0.37.1
• Applications using cpp-httplib streaming API (httplib::stream::Get, httplib::stream::Post, etc.)
• Any client application connecting to untrusted or potentially compromised servers

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-31870 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31870

Vulnerability Analysis

This vulnerability is classified under CWE-248 (Uncaught Exception), which describes scenarios where an exception is thrown but not properly caught or handled by the application. In the case of cpp-httplib, the streaming API implementation directly parses the Content-Length HTTP header using std::stoull() without any input validation or exception handling mechanisms.

The std::stoull() function in C++ is designed to convert a string to an unsigned long long integer. However, when provided with malformed input—such as non-numeric characters or values that exceed ULLONG_MAX—it throws exceptions that bubble up through the call stack. Without a try-catch block to handle these exceptions, the C++ runtime invokes std::terminate(), resulting in immediate process termination via SIGABRT.

Root Cause

The root cause is improper input validation combined with missing exception handling (CWE-248). The cpp-httplib library trusts the Content-Length header value from remote servers without sanitizing or validating the input before attempting to convert it to a numeric type. The streaming API functions do not wrap the std::stoull() call in exception handling, allowing any malformed header value to crash the client application.

Attack Vector

This vulnerability can be exploited remotely over the network without authentication. An attacker can exploit this vulnerability through multiple attack vectors:

1. Malicious Server: An attacker-controlled server responds to legitimate client requests with a malformed Content-Length header
2. Man-in-the-Middle (MITM): An attacker intercepts HTTP traffic and injects malformed Content-Length headers into responses
3. HTTP Redirects: A legitimate server redirects the client to an attacker-controlled endpoint that delivers the malicious response
4. Compromised Third-Party APIs: If the client application interacts with third-party APIs, any compromised endpoint can trigger the vulnerability

The attack requires sending an HTTP response with a Content-Length header containing either non-numeric characters (triggering std::invalid_argument) or a value exceeding ULLONG_MAX (triggering std::out_of_range). For example, a response header like Content-Length: AAAAAAAA or Content-Length: 99999999999999999999999999 would trigger the crash when processed by vulnerable cpp-httplib streaming API calls.

Detection Methods for CVE-2026-31870

Indicators of Compromise

• Unexpected client application crashes with SIGABRT signal
• Core dumps showing std::terminate() in the stack trace originating from cpp-httplib code
• Network traffic containing HTTP responses with malformed Content-Length headers (non-numeric or excessively large values)
• Application logs showing abnormal termination during HTTP streaming operations

Detection Strategies

• Monitor application crash logs for SIGABRT signals and stack traces involving std::stoull() or std::terminate()
• Implement network-level inspection to flag HTTP responses with malformed Content-Length headers
• Deploy application performance monitoring to detect unexpected process terminations correlating with HTTP client activity
• Review cpp-httplib version in use across applications to identify vulnerable deployments

Monitoring Recommendations

• Set up alerting for sudden client application crashes during HTTP operations
• Monitor network traffic for anomalous HTTP response headers at ingress points
• Implement health checks that can detect and alert on unexpected process terminations
• Use endpoint detection and response (EDR) solutions to correlate SIGABRT crashes with network activity

How to Mitigate CVE-2026-31870

Immediate Actions Required

• Upgrade cpp-httplib to version 0.37.1 or later immediately
• Audit all applications using cpp-httplib to identify those utilizing the streaming API
• Consider implementing network-level filtering to validate Content-Length headers before they reach vulnerable applications
• If immediate patching is not possible, restrict client applications from connecting to untrusted servers

Patch Information

The vulnerability is fixed in cpp-httplib version 0.37.1. The fix adds proper input validation and exception handling for the Content-Length header parsing in the streaming API. Organizations should update their dependencies to the patched version as soon as possible.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Wrap cpp-httplib streaming API calls in try-catch blocks at the application level to prevent uncaught exceptions from terminating the process
• Implement a reverse proxy or web application firewall (WAF) that validates Content-Length headers before forwarding responses to client applications
• Restrict client applications to connect only to trusted, controlled servers until the patch can be applied
• Consider implementing a watchdog process to restart crashed applications while awaiting permanent remediation

# Verify cpp-httplib version in your project
# Check header file for version information
grep -r "CPPHTTPLIB_VERSION" /path/to/your/project

# Update cpp-httplib to patched version
# If using as a git submodule:
cd /path/to/cpp-httplib
git fetch --tags
git checkout v0.37.1

# If using package manager, update to latest version
# Example for vcpkg:
vcpkg upgrade cpp-httplib