Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0033 25.7 —
AFFECTED Product Versions Fixed cpp-httplib < 0.43.4 – —
TIMELINE May 11 Reserved by GitHub_M May 29 EXPLOIT PUBLISHED — CVE-2026-45352 (yhirose cpp-httplib). Public exploit reference added. May 29 Published (CNA: GitHub_M)
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul("-2", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of "-1"), but any other negative value such as "-2" passes validation. The resulting near-maximum value is stored in chunk_remaining and controls how many bytes the server's read loop consumes from the network. This vulnerability is fixed in 0.43.4.
| Date | Event | Detail |
|---|---|---|
| May 11, 2026 | Reserved | Reserved by GitHub_M |
| May 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-45352 (yhirose cpp-httplib). Public exploit reference added. |
| May 29, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| yhirose | cpp-httplib | — | < 0.43.4 | — |
Authoritative record: CVE-2026-45352 at cve.org
Vendors: yhirose
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45352 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.