CVE-2026-31870
Yhirose Cpp-Httplib ≤ 0.37.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-31870 is a high-severity Uncaught Exception (CWE-248) vulnerability in Yhirose Cpp-Httplib. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31870 is a vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library, affecting versions prior to 0.37.1. It arises when a client uses the streaming API, such as httplib::stream::Get or httplib::stream::Post. The library invokes std::stoull() directly on the Content-Length header value received from the server without input validation or exception handling. Non-numeric strings trigger std::invalid_argument, while values exceeding ULLONG_MAX trigger std::out_of_range; uncaught exceptions lead to std::terminate(), terminating the process with SIGABRT.
Any server the client connects to—including those via HTTP redirects, third-party APIs, or man-in-the-middle positions—can exploit this by sending a single HTTP response with a malformed Content-Length header, crashing the client application deterministically and immediately. No authentication or end-user interaction is required, enabling remote denial-of-service. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), mapped to CWE-248.
The issue is addressed in cpp-httplib version 0.37.1. Additional details are available in the GitHub security advisory at https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11275
Vulnerability Data
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no…
more
input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Security engineering principles include robust exception management to keep the system in a defined state.
Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.
Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uncaught exceptions before production deployment.
Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.
Application security requirements typically mandate robust error and exception handling.
Secure architecture principles call for centralized, comprehensive exception management.
Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.