A negative chunk-size in HTTP chunked Transfer‑Encoding can trigger an unbounded memory allocation and process crash in cpp‑httplib versions before 0.43.4. The library parses the chunk‑size using std::strtoul(), which accepts a leading minus sign and performs unsigned wrap‑around; only the literal '-1' is validated against ULONG_MAX, so values such as '-2' are allowed. The resulting near‑maximum value is used as the amount of data the server attempts to read, leading to excessive memory allocation and eventual crash. The vulnerability therefore provides a denial‑of‑service path by consuming server resources and killing the process.

The issue affects the cpp‑httplib library released by yhirose. Any deployment using cpp‑httplib 0.43.3 or earlier is vulnerable. The library is a single‑file C++11 HTTP/HTTPS header‑only component used in a variety of projects.

The CVSS score of 5.3 indicates a moderate severity. No EPSS value is available and the flaw is not currently listed in the CISA KEV catalog, but the exploit can be performed remotely by sending a crafted HTTP request with a negative chunk‑size header. An attacker only needs network access to the endpoint that uses the library to trigger the crash, resulting in service disruption. Given these factors, the risk remains significant for exposed services that cannot protect against malformed requests.