High severity · published Jun 26, 2025
CVE-2025-52887
cpp-httplib has unlimited number of http header fields, which causes memory leak
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
cpp-httplib · yhirose
= 0.21.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52887
Patch
https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9
Exploit
https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h
More from cpp-httplib
9.9
CVE-2026-45372
cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection
9.8
CVE-2025-66570
cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)
8.8
CVE-2025-53628
cpp-httplib does not limit the length of a line
8.8
CVE-2023-26130
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch,…
8.2
CVE-2026-77358
cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()