cpp-httplib does not enforce the maximum payload length on a decompressed request body when using streaming ContentReader with Content-Encoding gzip. A small compressed payload can therefore expand beyond the configured limit and be processed by the application, allowing a payload size limit bypass. This flaw can consume excessive CPU or memory, resulting in a denial of service and application unavailability.

The vulnerability affects the yhirose:cpp-httplib library, specifically versions prior to 0.35.0. The issue arises in the HandlerWithContentReader use case when Server::set_payload_max_length() is not checked after decompression.

With a CVSS score of 7.5, the flaw is considered high severity but the EPSS score is below 1%, indicating a low probability of exploitation at the current time and it is not listed in the KEV catalog. The likely attack vector is remote, through an HTTP(S) request that includes a gzip‑encoded payload that, when decompressed, exceeds the application’s configured size limit. An attacker can trigger excessive resource consumption and cause a denial of service.