CVE-2026-28435Disclosure(yhirose / cpp-httplib)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch yhirose cpp-httplib systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.

yhirose CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/yhirose/cpp-httplib/commit/c99d7472b5cf4869d3897b9afc9792063a3d15a8

Exploit / PoC references

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp

Weakness type (CWE)

CWE-400CWE-409

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cpp-httplib

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-04); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

yhirose

Products

cpp-httplib

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-04	2	Disclosure1General1
2026-03-05	1	Disclosure1
2026-03-20	1	Patch1

Full discourse4 posts

Ferramentas Linux@Cezar_H_Linux202d
Patch
Critical security advisory for #Fedora 44: The cpp-httplib package has been updated to version 0.37.1 to address multiple high-severity DoS vulnerabilities (CVE-2026-31870, CVE-2026-29076, CVE-2026-28435). Read more:👉 https://tinyurl.com/ybtpw3xm #Security https://t.co/P7XApjmMQO
Post summary
Fedora 44 receives a critical advisory; a new cpp-httplib 0.37.1 update patches three high‑severity DoS CVEs, with no PoC, exploit code, or active exploitation reported.
0000083
1.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds217d
Disclosure
CVE-2026-28435 Payload Size Limit Bypass in cpp-httplib Prior to 0.35.0 via Decompression https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28435
Post summary
The post discloses a payload size limit bypass in cpp-httplib (prior to 0.35.0) via decompression, offering technical detail but no PoC, exploit, or patch information.
0000066
4.0K followersView on X
Infoflowcloud@infoflowcloud217d
Disclosure
🚨*CVE* CVE-2026-28435 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_le… https://www.cve.org/CVERecord?id=CVE-2026-28435 ----- Traducción: CVE-2026-28435 cpp… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-28435, noting that cpp-httplib before version 0.35.0 lacks enforcement of Server payload size, and links to the CVE record for details.
0000027
56 followersView on X
CVE@CVEnew217d
General
CVE-2026-28435 cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_le… https://www.cve.org/CVERecord?id=CVE-2026-28435
Post summary
The message states that cpp-httplib versions prior to 0.35.0 lack enforcement of a payload limit and provides a link to the CVE record, but no additional technical, exploit, or mitigation details.
00000225
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	yhirose	cpp-httplib	-	-	-

Explore more

Back to dashboard yhirose CVEs cpp-httplib vulnerabilities

What researchers are saying

CVE-2026-28435

Ferramentas Linux@Cezar_H_LinuxPatch

Fedora 44 receives a critical advisory; a new cpp-httplib 0.37.1 update patches three high‑severity DoS CVEs, with no PoC, exploit code, or active exploitation reported.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post discloses a payload size limit bypass in cpp-httplib (prior to 0.35.0) via decompression, offering technical detail but no PoC, exploit, or patch information.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2026-28435, noting that cpp-httplib before version 0.35.0 lacks enforcement of Server payload size, and links to the CVE record for details.

CVE@CVEnewGeneral

The message states that cpp-httplib versions prior to 0.35.0 lack enforcement of a payload limit and provides a link to the CVE record, but no additional technical, exploit, or mitigation details.