The vulnerability arises from cpp-httplib’s use of libstdc++’s std::regex to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine implements backtracking through deep recursion, consuming one stack frame per input character. An attacker can craft a filename* parameter that triggers uncontrolled recursion, leading to a stack overflow (SIGSEGV) that crashes the server process. The flaw is classified as Stack-based Buffer Overflow and Uncontrolled Recursion (CWE-1333 and CWE-674), resulting in a denial of service by terminating the application.

All installations of the cpp-httplib single‑file header library version 0.36.0 and earlier, authored by yhirose, are affected. The library is commonly embedded in C++ projects that handle HTTP or HTTPS requests, and any process that employs multipart parsing with this library version is susceptible.

The CVSS score of 5.9 indicates moderate severity. The EPSS probability is less than 1%, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the application’s HTTP interface to send a POST request with a malicious filename* value. Once the crafted request hits the vulnerable regex parser, the application crashes, causing a denial of service.