Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31870cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header

High 7.5

In plain English

A high-severity security flaw in cpp-httplib from yhirose. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	cpp-httplib	no fix listed	DEBIAN-CVE-2026-31870
Debian:13	cpp-httplib	no fix listed	DEBIAN-CVE-2026-31870
Debian:14	cpp-httplib	0.41.0+ds-3	DEBIAN-CVE-2026-31870
Ubuntu:25.10	cpp-httplib	no fix listed	UBUNTU-CVE-2026-31870
Ubuntu:26.10	cpp-httplib	no fix listed	UBUNTU-CVE-2026-31870

Affected products (as reported)

Vendor	Product	Versions
yhirose	cpp-httplib	< 0.37.1

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx x_refsource_CONFIRM