cpp-httplib is a header‑only C++11 HTTP/HTTPS library. The defect lies in its handling of compressed HTTP request bodies. While the library checks that the compressed payload does not exceed a preset maximum length, it does not impose any limit on the size of the data after decompression. An attacker can therefore send a gzip or br encoded body that expands dramatically when decompressed, causing excessive memory allocation and ultimately exhausting the application’s resources.

The vulnerability affects all deployments of yhirose:cpp‑httplib built with a version earlier than 0.30.1, regardless of operating system, because the library is header‑only and used wherever the header is included in an application.

The vulnerability is rated with a CVSS score of 8.7, indicating a high severity risk. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is remote: an adversary can target a server or service that includes the vulnerable library by sending a specially crafted HTTP request with a compressed body that expands to consume large amounts of memory, leading to a denial of service by exhausting system resources and affecting application availability.