CVE-2025-53628
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-08-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| yhirose | cpp-httplib | to 0.20.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-444 | The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. |
| CWE-835 | The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in cpp-httplib versions prior to 0.20.1, where there is no limit on the length of a unique line in HTTP requests. This allows an attacker to exploit the lack of limits to allocate memory arbitrarily, potentially leading to resource exhaustion or other memory-related issues. The issue was fixed in version 0.20.1.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to cause arbitrary memory allocation by sending specially crafted HTTP requests with very long lines. This can lead to denial of service conditions by exhausting system memory or causing instability in applications using vulnerable versions of cpp-httplib.
What immediate steps should I take to mitigate this vulnerability?
Update cpp-httplib to version 0.20.1 or later, as this version includes the fix for the vulnerability related to arbitrary memory allocation caused by unlimited line length.