CVE-2026-31870

HighPublic PoC

Published: 11 March 2026

Published

11 March 2026

Modified

18 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0009 24.9th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31870 is a high-severity Uncaught Exception (CWE-248) vulnerability in Yhirose Cpp-Httplib. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-24 Fail in Known State

addresses: CWE-248

Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode.

SI-17 Fail-safe Procedures

addresses: CWE-248

Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Uncaught exception in Content-Length parsing (std::stoull) allows remote server or MITM to deterministically crash client via single malformed HTTP response, directly matching Application or System Exploitation for Endpoint DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no…

input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.

Deeper analysisAI

CVE-2026-31870 is a vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library, affecting versions prior to 0.37.1. It arises when a client uses the streaming API, such as httplib::stream::Get or httplib::stream::Post. The library invokes std::stoull() directly on the Content-Length header value received from the server without input validation or exception handling. Non-numeric strings trigger std::invalid_argument, while values exceeding ULLONG_MAX trigger std::out_of_range; uncaught exceptions lead to std::terminate(), terminating the process with SIGABRT.

Any server the client connects to—including those via HTTP redirects, third-party APIs, or man-in-the-middle positions—can exploit this by sending a single HTTP response with a malformed Content-Length header, crashing the client application deterministically and immediately. No authentication or end-user interaction is required, enabling remote denial-of-service. The CVSS v3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), mapped to CWE-248.

The issue is addressed in cpp-httplib version 0.37.1. Additional details are available in the GitHub security advisory at https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx.