CVE-2026-22776

Katalog CVE

CVSS 7.5 · High EPSS 0,41%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada yhirose cpp-httplib. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.

Rincian

Terbit di NVD

12 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h934-98h4-j43q exploit · advisory vendor
• https://github.com/yhirose/cpp-httplib/commit/2e2e47bab1ae6a853476eecbc4bf279dd1fef792 patch