# CVE-2026-46527: yhirose cpp-httplib denial of service via malformed X-Forwarded-For header

Source: https://junglewise.ai/threats/cve-2026-46527-yhirose-cpp-httplib-denial-of-service-via-malformed-x-forwarded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-46527 · Severity: info · CVSS 8.7 · Published 2026-05-29

cpp-httplib is a widely used C++ library for adding web server and client functionality to applications. A vulnerability exists where a specially crafted web request can cause the server to crash, leading to a denial of service. This occurs specifically when the server is configured to trust certain network proxies and receives a malformed header. This could disrupt business operations by taking down services that rely on this library for communication.

Technologies: [Yhirose Cpp-Httplib](https://junglewise.ai/threats/technologies/cpp-httplib). Vendors: [Yhirose](https://junglewise.ai/threats/vendors/yhirose).

## Quick answers

**Is CVE-2026-46527 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46527 being exploited in the wild.

**How severe is CVE-2026-46527?** Informational severity, with a CVSS score of 8.7, published 29 May 2026.

**Which products and versions are affected?** Yhirose Cpp-Httplib < 0.44.0.

**Is there a fix for CVE-2026-46527?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-46527 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46527?** Check whether you run Yhirose Cpp-Httplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic flaw exists in the `get_client_ip()` function of `httplib.h`. When `Server::set_trusted_proxies()` is configured with a non-empty list, the server attempts to parse the `X-Forwarded-For` header. If an attacker sends a request with an empty, whitespace-only, or comma-only `X-Forwarded-For` header, the `detail::split` function fails to populate the `ip_list` vector. The code subsequently calls `ip_list.front()` on the empty vector, which is undefined behavior in C++. In most environments, this results in a segmentation fault or abnormal process termination. The vulnerability is reachable without authentication over the network. It is fixed in version 0.44.0.

## Affected products

- yhirose cpp-httplib < 0.44.0

## Timeline

- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD

## References

- [https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g](https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g)

## Related threats

- [cpp-httplib cookie exposure in cross-origin redirect](https://junglewise.ai/threats/cve-2026-102944-cpp-httplib-is-a-c-header-only-http-https-library-prior-to-0-51)
- [cpp-httplib use-after-free in TLS WebSocket client](https://junglewise.ai/threats/cve-2026-77358-cpp-httplib-use-after-free-in-tls-websocket-client)
- [cpp-httplib CRLF injection in chunked response trailers](https://junglewise.ai/threats/cve-2026-77341-cpp-httplib-crlf-injection-in-chunked-response-trailers)
- [yhirose cpp-httplib CRLF injection in parse_header](https://junglewise.ai/threats/cve-2026-45372-yhirose-cpp-httplib-crlf-injection-in-parse-header)
- [yhirose cpp-httplib denial of service via negative chunk-size](https://junglewise.ai/threats/cve-2026-45352-yhirose-cpp-httplib-denial-of-service-via-negative-chunk-size)