CVE-2025-46728 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-46728 Interim 1 5 2026-03-05T00:33:47Z current 2025-05-08T23:11:52Z 2026-03-05T00:33:47Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-46728 cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Server 16.0 SUSE Package Hub 15 SP6 openSUSE Leap 15.6 openSUSE Tumbleweed cpp-httplib-devel-0.20.1-1.1 cpp-httplib-devel-0.20.1-bp156.2.9.1 libcpp-httplib0_12-0.12.5-bp156.2.6.1 libcpp-httplib0_20-0.20.1-1.1 libcpp-httplib0_20-0.20.1-bp156.2.9.1 libcpp-httplib0_22-0.22.0-160000.2.2 libcpp-httplib0_22-0.22.0-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 cpp-httplib-devel-0.20.1-bp156.2.9.1 as a component of SUSE Package Hub 15 SP6 libcpp-httplib0_12-0.12.5-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 libcpp-httplib0_20-0.20.1-bp156.2.9.1 as a component of SUSE Package Hub 15 SP6 cpp-httplib-devel-0.20.1-bp156.2.9.1 as a component of openSUSE Leap 15.6 libcpp-httplib0_12-0.12.5-bp156.2.6.1 as a component of openSUSE Leap 15.6 libcpp-httplib0_20-0.20.1-bp156.2.9.1 as a component of openSUSE Leap 15.6 cpp-httplib-devel-0.20.1-1.1 as a component of openSUSE Tumbleweed libcpp-httplib0_20-0.20.1-1.1 as a component of openSUSE Tumbleweed cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when `Transfer-Encoding: chunked` is used or when no `Content-Length` header is provided. A remote attacker can send a chunked request without the terminating zero-length chunk, causing uncontrolled memory allocation on the server. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits during parsing. If the limit is exceeded at any point during reading, the connection is terminated immediately. A short-term workaround through a Reverse Proxy is available. If updating the library immediately is not feasible, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the `cpp-httplib` application. Configure the proxy to enforce maximum request body size limits, thereby stopping excessively large requests before they reach the vulnerable library code. CVE-2025-46728 SUSE Linux Enterprise Server 16.0:libcpp-httplib0_22-0.22.0-160000.2.2 SUSE Package Hub 15 SP6:cpp-httplib-devel-0.20.1-bp156.2.9.1 SUSE Package Hub 15 SP6:libcpp-httplib0_12-0.12.5-bp156.2.6.1 SUSE Package Hub 15 SP6:libcpp-httplib0_20-0.20.1-bp156.2.9.1 openSUSE Leap 15.6:cpp-httplib-devel-0.20.1-bp156.2.9.1 openSUSE Leap 15.6:libcpp-httplib0_12-0.12.5-bp156.2.6.1 openSUSE Leap 15.6:libcpp-httplib0_20-0.20.1-bp156.2.9.1 openSUSE Tumbleweed:cpp-httplib-devel-0.20.1-1.1 openSUSE Tumbleweed:libcpp-httplib0_20-0.20.1-1.1 important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H