CVE-2026-46527: Yhirose Cpp-httplib DOS Vulnerability

CVE-2026-46527 Overview

CVE-2026-46527 affects cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library maintained by yhirose. The vulnerability exists in versions prior to 0.44.0 when the server has configured a trusted-proxy list via Server::set_trusted_proxies(). An unauthenticated remote attacker can send a crafted HTTP request containing an X-Forwarded-For header that parses to zero valid IP segments. The get_client_ip() function then invokes front() on an empty std::vector, which is undefined behavior under [CWE-476]. The result is abnormal process termination and denial of service. The flaw is fixed in version 0.44.0.

Critical Impact
Unauthenticated remote attackers can crash any cpp-httplib server configured with trusted proxies by sending a single malformed HTTP header.

Affected Products

yhirose cpp-httplib versions prior to 0.44.0
C++ applications embedding cpp-httplib with Server::set_trusted_proxies() configured
HTTP/HTTPS services deployed behind reverse proxies using this library

Discovery Timeline

2026-05-29 - CVE-2026-46527 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-46527

Vulnerability Analysis

The vulnerability is a null pointer dereference style fault arising from calling front() on an empty container. When a cpp-httplib server is configured with a non-empty trusted-proxy list, the request handling code path inspects the X-Forwarded-For header to identify the originating client. The parsed IP segments are stored in a std::vector. If parsing yields no valid IP entries, the subsequent call to get_client_ip() invokes front() on that empty vector. In C++, calling front() on an empty std::vector is undefined behavior. On most production builds this triggers a segmentation fault and process termination, producing a denial of service condition.

Root Cause

The root cause is missing input validation before container access. The code assumes that any X-Forwarded-For header value will yield at least one parseable IP segment. No empty() check is performed prior to dereferencing the first element. This violates safe-container access practices in modern C++ and falls under [CWE-476] Null Pointer Dereference semantics for STL containers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to any endpoint served by a vulnerable cpp-httplib server with trusted proxies configured. The request includes an X-Forwarded-For header whose value parses to zero valid IP segments. Examples include empty strings, whitespace-only values, or strings containing only invalid delimiters. The server process crashes on receipt, terminating in-flight connections and halting service until restart.

No verified public proof-of-concept exploit has been published. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-hg3g-vrg8-578g.

Detection Methods for CVE-2026-46527

Indicators of Compromise

Unexpected process termination or segmentation faults in cpp-httplib-based server binaries
HTTP access logs showing requests with malformed or empty X-Forwarded-For header values immediately before process exit
Core dumps with stack traces referencing get_client_ip() and std::vector::front()
Repeated service restarts by supervisor processes such as systemd or container orchestrators

Detection Strategies

Inventory C++ applications and identify those statically linking or embedding cpp-httplib below version 0.44.0
Inspect application source for calls to Server::set_trusted_proxies() to determine exposure
Enable AddressSanitizer or UndefinedBehaviorSanitizer in non-production builds to surface the empty-vector access at runtime
Monitor reverse-proxy and edge logs for anomalous X-Forwarded-For header values

Monitoring Recommendations

Alert on repeated abnormal exits of HTTP service processes within short time windows
Forward HTTP request headers and crash telemetry to a centralized logging platform for correlation
Track service availability metrics for cpp-httplib-based endpoints to detect crash-loop patterns

How to Mitigate CVE-2026-46527

Immediate Actions Required

Upgrade cpp-httplib to version 0.44.0 or later and rebuild all dependent applications
Audit deployments for use of Server::set_trusted_proxies() and prioritize patching those instances
Place vulnerable services behind a Web Application Firewall capable of filtering malformed X-Forwarded-For headers until the upgrade is complete

Patch Information

The fix is available in cpp-httplib version 0.44.0. The maintainer added validation to prevent calling front() on an empty IP segment vector. Refer to the GitHub Security Advisory GHSA-hg3g-vrg8-578g for upstream remediation details.

Workarounds

Remove or comment out calls to Server::set_trusted_proxies() until the library can be upgraded, accepting the loss of proxy-aware client IP resolution
Configure upstream reverse proxies such as nginx or HAProxy to strip or sanitize empty and malformed X-Forwarded-For headers before they reach the cpp-httplib server
Deploy a request validation layer that rejects requests with empty or whitespace-only X-Forwarded-For values

bash

# nginx workaround: sanitize X-Forwarded-For before proxying to cpp-httplib backend
location / {
    if ($http_x_forwarded_for = "") {
        set $http_x_forwarded_for $remote_addr;
    }
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://cpp_httplib_backend;
}