# CVE-2026-45352: yhirose cpp-httplib denial of service via negative chunk-size

Source: https://junglewise.ai/threats/cve-2026-45352-yhirose-cpp-httplib-denial-of-service-via-negative-chunk-size  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-45352 · Severity: medium · CVSS 5.3 · Published 2026-05-29

cpp-httplib is a widely used C++ library that allows applications to handle web traffic (HTTP/HTTPS). A flaw in how the library processes data transfers allows a remote attacker to send a specially crafted request that forces the server to attempt to allocate an impossible amount of memory. This results in an immediate crash of the application, leading to a denial-of-service (DoS) where the service becomes unavailable to legitimate users.

Technologies: [Yhirose Cpp-Httplib](https://junglewise.ai/threats/technologies/cpp-httplib). Vendors: [Yhirose](https://junglewise.ai/threats/vendors/yhirose).

## Quick answers

**Is CVE-2026-45352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45352 being exploited in the wild.

**How severe is CVE-2026-45352?** Medium severity, with a CVSS score of 5.3, published 29 May 2026.

**Which products and versions are affected?** Yhirose Cpp-Httplib < 0.43.4.

**Is there a fix for CVE-2026-45352?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45352 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45352?** Check whether you run Yhirose Cpp-Httplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ChunkedDecoder::read_payload function in httplib.h uses std::strtoul() to parse the chunk-size field of HTTP chunked transfer encoding. Because strtoul() performs unsigned wrap-around for negative inputs, a value such as '-2' is interpreted as a near-maximum unsigned long value (e.g., 0xFFFFFFFFFFFFFFFE). While the library explicitly checks for and rejects ULONG_MAX (the result of '-1'), it fails to validate other negative inputs. This causes the server to enter a read loop attempting to consume an extremely large amount of data, leading to unbounded memory allocation (std::bad_alloc) and a process crash. The vulnerability is fixed in version 0.43.4 by ensuring the parser correctly rejects non-hexadecimal characters like the leading minus sign.

## Affected products

- yhirose cpp-httplib < 0.43.4

## Timeline

- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-45352 published to NVD

## References

- [https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8)

## Related threats

- [cpp-httplib cookie exposure in cross-origin redirect](https://junglewise.ai/threats/cve-2026-102944-cpp-httplib-is-a-c-header-only-http-https-library-prior-to-0-51)
- [cpp-httplib use-after-free in TLS WebSocket client](https://junglewise.ai/threats/cve-2026-77358-cpp-httplib-use-after-free-in-tls-websocket-client)
- [cpp-httplib CRLF injection in chunked response trailers](https://junglewise.ai/threats/cve-2026-77341-cpp-httplib-crlf-injection-in-chunked-response-trailers)
- [yhirose cpp-httplib denial of service via malformed X-Forwarded-For header](https://junglewise.ai/threats/cve-2026-46527-yhirose-cpp-httplib-denial-of-service-via-malformed-x-forwarded)
- [yhirose cpp-httplib CRLF injection in parse_header](https://junglewise.ai/threats/cve-2026-45372-yhirose-cpp-httplib-crlf-injection-in-parse-header)