The cpp-httplib library, prior to version 0.23.0, is vulnerable to a denial of service attack that can be triggered by unauthenticated remote parties to exhaust server memory.

This vulnerability is an allocation of resources without limits (CWE-770), occurring when the library processes incoming HTTP requests containing Transfer-Encoding: chunked headers. An unauthenticated attacker can send specifically crafted requests to force the server to allocate arbitrary amounts of memory, leading to resource exhaustion.

The successful exploitation of this vulnerability results in a denial of service, which can cause significant disruption to business operations by rendering web services unavailable. With a CVSS score of 7.5, this issue represents a high risk to availability, particularly for public-facing applications that rely on the affected library for handling network traffic.

Immediate Action: Update the yhirose cpp-httplib library to version 0.23.0 or later to implement proper resource throttling and memory management.

Proactive Monitoring: Monitor server memory utilization and process health for sudden spikes or unexpected restarts that could indicate a memory exhaustion attack.

Compensating Controls: Deploy a Web Application Firewall (WAF) or load balancer configured to inspect and reject malformed HTTP requests, particularly those with suspicious or oversized Transfer-Encoding headers.

Public Exploit Available: No.

Given the ease of exploitation and the potential for service disruption, administrators should prioritize updating to version 0.23.0 immediately. Organizations using this library in production environments should treat this as a high-priority maintenance item to ensure the continued availability and stability of their network services.