Every CVE Search/ Get API key

CVE-2026-29076

cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing

5.9 MediumFix available

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.70%Up 0.7 points since Mar 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
CVE-2026-29076
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-10158 5.9

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
EUVD-2026-10158
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
NVD 5.9

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
CVE-2026-29076
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-674, CWE-1333
Updated
2026-11-02
OSV 5.9

cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
CVE-2026-29076
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-29076 5.9

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
DEBIAN-CVE-2026-29076
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1552 7.5

cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!

Security Fix(es):

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.(CVE-2026-28434)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.(CVE-2026-28435)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.(CVE-2026-29076)

Record
OESA-2026-1552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVOESA-2026-1553 7.5

cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!

Security Fix(es):

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.(CVE-2026-28434)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.(CVE-2026-28435)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.(CVE-2026-29076)

Record
OESA-2026-1553
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1554 7.5

cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!

Security Fix(es):

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.(CVE-2026-28434)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.(CVE-2026-28435)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.(CVE-2026-29076)

Record
OESA-2026-1554
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1555 7.5

cpp-httplib security update

A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!

Security Fix(es):

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.(CVE-2026-28434)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.(CVE-2026-28435)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.(CVE-2026-29076)

Record
OESA-2026-1555
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-29076 5.9

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.

Record
UBUNTU-CVE-2026-29076
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2026:10435-1 No score

cpp-httplib-devel-0.38.0-1.1 on GA media

These are all security issues fixed in the cpp-httplib-devel-0.38.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10435-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20733-1 No score

Security update for cpp-httplib

This update for cpp-httplib fixes the following issues

  • CVE-2026-21428: server-side request forgery via header injection (bsc#1255835).
  • CVE-2026-22776: unsafe handling of compressed HTTP request can cause a denial of service (bsc#1256518).
  • CVE-2026-28434: default exception handler may leak e.what() to clients via EXCEPTION_WHAT response header (bsc#1259221).
  • CVE-2026-28435: payload size limit bypass via gzip decompression in ContentReader (streaming) can lead to denial of service (bsc#1259220).
  • CVE-2026-29076: denial of service via crafted HTTP POST request (bsc#1259373).
Record
openSUSE-SU-2026:20733-1
Updated
2026-11-02
OSVSUSE-SU-2026:21599-1 No score

Security update for cpp-httplib

This update for cpp-httplib fixes the following issues

  • CVE-2026-21428: server-side request forgery via header injection (bsc#1255835).
  • CVE-2026-22776: unsafe handling of compressed HTTP request can cause a denial of service (bsc#1256518).
  • CVE-2026-28434: default exception handler may leak e.what() to clients via EXCEPTION_WHAT response header (bsc#1259221).
  • CVE-2026-28435: payload size limit bypass via gzip decompression in ContentReader (streaming) can lead to denial of service (bsc#1259220).
  • CVE-2026-29076: denial of service via crafted HTTP POST request (bsc#1259373).
Record
SUSE-SU-2026:21599-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cpp-httplib
Debian:12
 All versions, plus listed versions
0.11.4+ds-10.11.4+ds-1+deb12u10.11.4+ds-20.11.4+ds-30.13.1+ds-1
Show 22 moreShow less
0.14.0+ds-10.14.1+ds-10.14.1+ds-20.14.2+ds-10.14.3+ds-10.14.3+ds-1.10.14.3+ds-1.1~exp10.15.3+ds-10.15.3+ds-20.15.3+ds-30.16.0+ds-10.16.3+ds-10.16.3+ds-20.18.0+ds-10.18.7-10.20.1+ds-30.25.0+ds-10.26.0+ds-20.41.0+ds-10.41.0+ds-20.41.0+ds-30.41.0+ds-3~bpo13+1
 None known
cpp-httplib
Debian:13
 All versions, plus listed versions
0.18.7-10.18.7-1+deb13u10.20.1+ds-30.25.0+ds-10.26.0+ds-2
Show 4 moreShow less
0.41.0+ds-10.41.0+ds-20.41.0+ds-30.41.0+ds-3~bpo13+1
 None known
cpp-httplib
Debian:14
 before 0.41.0+ds-3, plus listed versions
0.18.7-10.20.1+ds-30.25.0+ds-10.26.0+ds-20.41.0+ds-10.41.0+ds-20.41.0+ds-3~bpo13+1
0.41.0+ds-3
cpp-httplib
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 0.37.0-1.oe2403sp1
0.37.0-1.oe2403sp1
cpp-httplib
openEuler:24.03-LTS-SP2
From an advisory covering 3 CVEs
 before 0.37.0-1.oe2403sp2
0.37.0-1.oe2403sp2
cpp-httplib
openEuler:24.03-LTS-SP3
From an advisory covering 3 CVEs
 before 0.37.0-1.oe2403sp3
0.37.0-1.oe2403sp3
cpp-httplib
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 0.37.0-1.oe2403
0.37.0-1.oe2403
cpp-httplib
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
0.9.9+ds-10.9.10+ds-10.10.1+ds-10.10.2+ds-10.10.3+ds-10.10.3+ds-1ubuntu0.1~esm10.10.3+ds-1ubuntu0.1~esm2
 None known
cpp-httplib
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
0.13.1+ds-1ubuntu10.14.3+ds-10.14.3+ds-1.10.14.3+ds-1.1build10.14.3+ds-1.1build20.14.3+ds-1.1ubuntu0.1~esm10.14.3+ds-1.1ubuntu0.1~esm2
 None known
cpp-httplib
Ubuntu:25.10
 All versions, plus listed versions
0.18.7-10.18.7-1ubuntu0.25.10.10.18.7-1ubuntu0.25.10.2
 None known
cpp-httplib
Ubuntu:26.10
 All versions, plus listed versions
0.26.0+ds-2ubuntu30.26.0+ds-2ubuntu4
 None known
cpp-httplib
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
0.18.7-10.26.0+ds-2ubuntu20.26.0+ds-2ubuntu30.26.0+ds-2ubuntu3+esm1
 None known
cpp-httplib
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 0.38.0-1.1
0.38.0-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-29076 is a medium vulnerability (CVSS 5.9) in Yhirose Cpp-httplib, published March 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in cpp-httplib 0.41.0+ds-3.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open