cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6228 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6228-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 22, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : cpp-httplib     CVE ID         : CVE-2025-46728 CVE-2025-53629

    Multiple security issues were discovered in cpp-httplib, a C++ cross     platform HTTP/HTTPS library, which could result in denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 0.18.7-1+deb13u1.

    We recommend that you upgrade your cpp-httplib packages.

    For the detailed security status of cpp-httplib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cpp-httplib

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b0e5b457d advisory.

    # Update to 0.30.1

    - [Denial of service (DOS) using zip bomb (CVE-2026-22776)](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-h934-98h4-j43q)
    - [CRLF injection in http headers (CVE-2026-21428)](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-wpc6-j37r-jcx7)
    - [Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust     (CVE-2025-66577)](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2)

    https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0374 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-46728:
    cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the     library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding:
    chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked     request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server.
    This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness.
    Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point     during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy     is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx,     HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body     size limits, thereby stopping excessively large requests before they reach the vulnerable library code.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the     library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding:
    chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked     request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server.
    This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness.
    Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point     during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy     is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx,     HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body     size limits, thereby stopping excessively large requests before they reach the vulnerable library code.
    (CVE-2025-46728)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
309663	Debian dsa-6228 : libcpp-httplib-dev - security update	Nessus	Debian Local Security Checks	high
294951	Fedora 42 : cpp-httplib (2026-3b0e5b457d)	Nessus	Fedora Local Security Checks	high
276114	TencentOS Server 4: cpp-httplib (TSSA-2025:0374)	Nessus	Tencent Local Security Checks	high
251567	Linux Distros Unpatched Vulnerability : CVE-2025-46728	Nessus	Misc.	high

Detections

Analytics

CVE-2025-46728

high

Tenable Plugins

high

high

high

high