CVE-2026-22776

Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.

PUBLISHED Reserved 2026-01-09 | Published 2026-01-12 | Updated 2026-01-12 | Assigner GitHub_M

Problem types

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Product status

References

github.com/...ttplib/security/advisories/GHSA-h934-98h4-j43q

github.com/...ommit/2e2e47bab1ae6a853476eecbc4bf279dd1fef792

cve.org (CVE-2026-22776)

nvd.nist.gov (CVE-2026-22776)

Download JSON