The cpp-httplib library is vulnerable to a denial of service attack where malicious compressed request bodies can bypass size limits and exhaust system memory or CPU resources.

This vulnerability involves uncontrolled resource consumption (CWE-400) and improper handling of highly compressed data (CWE-409) within the library. An unauthenticated attacker can send a specially crafted gzip-compressed request body that expands beyond configured limits when processed by HandlerWithContentReader, effectively bypassing Server::set_payload_max_length.

The vulnerability presents a significant risk to application availability, as it enables remote denial of service attacks against services utilizing the affected library. With a CVSS score of 7.5, this flaw allows an unauthenticated attacker to crash services or degrade performance, potentially causing service outages and impacting business operations.

Immediate Action: Update the cpp-httplib dependency to version 0.35.0 or later to ensure proper enforcement of payload size limits on decompressed content.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for unexpected spikes that correlate with incoming HTTP POST or PUT requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block excessively large or malformed compressed request bodies before they reach the application backend.

Public Exploit Available: Unknown (no confirmed weaponized exploit or public PoC repository identified in available metadata).

Given the ease of exploitation and the potential for service disruption, organizations using cpp-httplib should prioritize updating to version 0.35.0 immediately. Verify all internal applications and third-party tools that integrate this library to ensure the patch is applied across the entire development environment.