cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3b0e5b457d advisory.

    # Update to 0.30.1

    - [Denial of service (DOS) using zip bomb (CVE-2026-22776)](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-h934-98h4-j43q)
    - [CRLF injection in http headers (CVE-2026-21428)](https://github.com/yhirose/cpp-     httplib/security/advisories/GHSA-wpc6-j37r-jcx7)
    - [Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust     (CVE-2025-66577)](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2)

    https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0374 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-46728:
    cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the     library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding:
    chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked     request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server.
    This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness.
    Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point     during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy     is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx,     HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body     size limits, thereby stopping excessively large requests before they reach the vulnerable library code.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the     library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding:
    chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked     request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server.
    This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness.
    Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point     during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy     is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx,     HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body     size limits, thereby stopping excessively large requests before they reach the vulnerable library code.
    (CVE-2025-46728)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
294951	Fedora 42 : cpp-httplib (2026-3b0e5b457d)	Nessus	Fedora Local Security Checks	high
276114	TencentOS Server 4: cpp-httplib (TSSA-2025:0374)	Nessus	Tencent Local Security Checks	high
251567	Linux Distros Unpatched Vulnerability : CVE-2025-46728	Nessus	Misc.	high

Detections

Analytics

CVE-2025-46728

high

Tenable Plugins

high

high

high