A malformed Content-Length header in an HTTP response triggers an unhandled exception in the C++ library cpp‑httplib when the client processes a streaming API response. The library invokes std::stoull without validating the header value, causing std::invalid_argument or std::out_of_range to be thrown for non‑numeric or overly large values. Because these exceptions are uncaught, the C++ runtime calls std::terminate(), terminating the client process with SIGABRT. This results in a deterministic, immediate crash, leading to a denial of service for the affected application.

The vulnerability affects projects using the yhirose:cpp‑httplib library prior to release 0.37.1. Any system that incorporates this library for HTTP or HTTPS client functionalities is susceptible.

The CVSS score is 7.5, indicating a high severity. The EPSS score is less than 1%, suggesting low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply sending an HTTP response with an invalid or overly large Content‑Length header; no authentication or user interaction is required.