CVE-2026-31870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31870", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T19:02:25.014Z", "datePublished": "2026-03-11T17:57:49.744Z", "dateUpdated": "2026-03-12T20:10:21.550Z"}, "containers": {"cna": {"title": "cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header", "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx"}], "affected": [{"vendor": "yhirose", "product": "cpp-httplib", "versions": [{"version": "< 0.37.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:57:49.744Z"}, "descriptions": [{"lang": "en", "value": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to \u2014 including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1."}], "source": {"advisory": "GHSA-39q5-hh6x-jpxx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T20:10:14.440555Z", "id": "CVE-2026-31870", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:10:21.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31870", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T20:10:14.440555Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:10:18.215Z"}}], "cna": {"title": "cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header", "source": {"advisory": "GHSA-39q5-hh6x-jpxx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "yhirose", "product": "cpp-httplib", "versions": [{"status": "affected", "version": "< 0.37.1"}]}], "references": [{"url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx", "name": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to \u2014 including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:57:49.744Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31870", "state": "PUBLISHED", "dateUpdated": "2026-03-12T20:10:21.550Z", "dateReserved": "2026-03-09T19:02:25.014Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T17:57:49.744Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cpp-httplib", "vendor": "yhirose", "versions": [{"status": "affected", "version": "< 0.37.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FC168D9-1A5B-44C8-BE39-60BA37CFA451", "versionEndExcluding": "0.37.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to \u2014 including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1."}, {"lang": "es", "value": "cpp-httplib es una biblioteca HTTP/HTTPS multiplataforma de un solo archivo y solo de cabecera para C++11. Antes de la versi\u00f3n 0.37.1, cuando un cliente cpp-httplib utiliza la API de streaming (httplib::stream::Get, httplib::stream::Post, etc.), la biblioteca llama directamente a std::stoull() sobre el valor del encabezado Content-Length recibido del servidor sin validaci\u00f3n de entrada y sin manejo de excepciones. std::stoull lanza std::invalid_argument para cadenas no num\u00e9ricas y std::out_of_range para valores que exceden ULLONG_MAX. Dado que nada captura estas excepciones, el tiempo de ejecuci\u00f3n de C++ llama a std::terminate(), lo que termina el proceso con SIGABRT. Cualquier servidor al que se conecte el cliente \u2014incluidos los servidores alcanzados a trav\u00e9s de redirecciones HTTP, APIs de terceros o posiciones de man-in-the-middle\u2014 puede bloquear la aplicaci\u00f3n cliente con una \u00fanica respuesta HTTP. No se requiere autenticaci\u00f3n. No se requiere interacci\u00f3n del usuario final. El bloqueo es determinista e inmediato. Esta vulnerabilidad se corrige en la versi\u00f3n 0.37.1."}], "id": "CVE-2026-31870", "lastModified": "2026-06-17T10:34:40.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31870", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T20:10:14.440555Z", "version": "2.0.3"}}]}, "published": "2026-03-11T18:16:26.487", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "cpp-httplib: cpp-httplib: Denial of Service via malformed Content-Length header", "id": "2446713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446713"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1287", "details": ["A flaw was found in cpp-httplib. A remote attacker, acting as a malicious server or through a man-in-the-middle position, can send a specially crafted HTTP response with a malformed Content-Length header. This lack of input validation and exception handling causes the client application to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-31870", "public_date": "2026-03-11T17:57:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31870\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31870\nhttps://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx"], "statement": "This IMPORTANT vulnerability in cpp-httplib allows a remote attacker, acting as a malicious server or through a man-in-the-middle position, to trigger a denial of service in client applications utilizing the streaming API. The flaw occurs due to insufficient input validation of the Content-Length header, leading to an application crash. No authentication or user interaction is required for successful exploitation. This affects Red Hat Community Projects that incorporate cpp-httplib, such as those in EPEL and Fedora.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.37.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cpp-httplib", "source": "cna", "vendor": "yhirose"}, "product": "cpp-httplib", "vendor": "yhirose"}], "analysis": {"en": {"generated_at": "2026-03-18T16:25:26.240875+00:00", "value": {"mitigation_remediation": ["Upgrade to cpp-httplib version 0.37.1 or later", "Verify library version after upgrade"], "summary": {"action": "Immediate Patch", "impact": "Client Process Crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects projects using the yhirose:cpp\u2011httplib library prior to release 0.37.1. Any system that incorporates this library for HTTP or HTTPS client functionalities is susceptible.", "description_and_impact": "A malformed Content-Length header in an HTTP response triggers an unhandled exception in the C++ library cpp\u2011httplib when the client processes a streaming API response. The library invokes std::stoull without validating the header value, causing std::invalid_argument or std::out_of_range to be thrown for non\u2011numeric or overly large values. Because these exceptions are uncaught, the C++ runtime calls std::terminate(), terminating the client process with SIGABRT. This results in a deterministic, immediate crash, leading to a denial of service for the affected application.", "risk_and_exploitability": "The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply sending an HTTP response with an invalid or overly large Content\u2011Length header; no authentication or user interaction is required."}}}}, "created": "2026-03-12T09:57:29.122511+00:00", "updated": "2026-03-20T15:30:03.641211+00:00", "vendors": ["yhirose", "yhirose$PRODUCT$cpp-httplib"]}