Forum: >>> Magnum BBS <<<

Bug#1109340: cpp-httplib: CVE-2025-52887 CVE-2025-53628 CVE-2025-53629

From =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=@21:1/5 to All on Tue Jul 15 14:40:01 2025

Package: cpp-httplib
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for cpp-httplib.

CVE-2025-52887[0]:
| cpp-httplib is a C++11 single-file header-only cross platform
| HTTP/HTTPS library. In version 0.21.0, when many http headers fields
| are passed in, the library does not limit the number of headers, and
| the memory associated with the headers will not be released when the
| connection is disconnected. This leads to potential exhaustion of
| system memory and results in a server crash or unresponsiveness.
| Version 0.22.0 contains a patch for the issue.

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9 (v0.22.0)

This might be specific to 0.21, but needs confirmation.

CVE-2025-53628[1]:
| cpp-httplib is a C++11 single-file header-only cross platform
| HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a
| limit for a unique line, permitting an attacker to explore this to
| allocate memory arbitrarily. This vulnerability is fixed in 0.20.1.
| NOTE: This vulnerability is related to CVE-2025-53629.

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e (v0.20.1)

CVE-2025-53629[2]:
| cpp-httplib is a C++11 single-file header-only cross platform
| HTTP/HTTPS library. Prior to 0.23.0, incoming requests using
| Transfer-Encoding: chunked in the header can allocate memory
| arbitrarily in the server, potentially leading to its exhaustion.
| This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is
| related to CVE-2025-53628.

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w https://github.com/yhirose/cpp-httplib/commit/17ba303889b8d4d719be3879a70639ab653efb99 (v0.23.0)

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-52887
https://www.cve.org/CVERecord?id=CVE-2025-52887
[1] https://security-tracker.debian.org/tracker/CVE-2025-53628
https://www.cve.org/CVERecord?id=CVE-2025-53628
[2] https://security-tracker.debian.org/tracker/CVE-2025-53629
https://www.cve.org/CVERecord?id=CVE-2025-53629

Please adjust the affected versions in the BTS as needed.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

From Debian Bug Tracking System@21:1/5 to All on Wed Jul 16 11:50:01 2025

Processing control commands:

found -1 0.18.7-1

Bug #1109340 [cpp-httplib] cpp-httplib: CVE-2025-52887 CVE-2025-53628 CVE-2025-53629
There is no source info for the package 'cpp-httplib' at version '0.18.7-1' with architecture ''
Unable to make a source version for version '0.18.7-1'
Marked as found in versions 0.18.7-1.

--
1109340: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1109340
Debian Bug Tracking System
Contact [email protected] with problems

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Who's Online
Recent Visitors
- Retrojimmyx
  Mon Sep 14 00:27:04 2026
  from Derbyshire via Telnet
- Rixter
  Mon Sep 14 00:01:35 2026
  from Madison, Nc via Telnet
- Sam Shaxted
  Sun Sep 13 14:48:09 2026
  from Sittingbourne, Kent via SSH
- Furryboy
  Sun Sep 13 13:32:38 2026
  from Romania, Galati via SSH
- Bob Worm
  Sun Sep 13 13:31:58 2026
  from Wales, Uk via Telnet
- Rixter
  Sun Sep 13 12:01:35 2026
  from Madison, Nc via Telnet
- Quenix
  Sun Sep 13 01:29:15 2026
  from Qu�bec, Canada via Telnet
- Rixter
  Sun Sep 13 00:01:34 2026
  from Madison, Nc via Telnet

System Info

Sysop:	Keyop
Location:	Huddersfield, West Yorkshire, UK
Users:	764
Nodes:	16 (2 / 14)
Uptime:	12:52:23
Calls:	12,754
Calls today:	2
Files:	15,355
Messages:	6,556,617

Bug#1109340: cpp-httplib: CVE-2025-52887 CVE-2025-53628 CVE-2025-53629

Who's Online

Recent Visitors

System Info