CVE-2025-52887: yhirose cpp-httplib

csirt@kutim:~/threat-intel/cve/CVE-2025-52887

CVSS 7.5 · High EPSS 0,49%

Kerentanan Uncontrolled Resource Consumption pada yhirose cpp-httplib. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue.

Rincian

Terbit di NVD: 26 Juni 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
yhirose	cpp-httplib	Versi 0.21.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h exploit · advisory vendor
https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.