CVE-2026-28435

Name of the Vulnerable Software and Affected Versions cpp-httplib versions prior to 0.35.0

Description cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Before version 0.35.0, the library does not enforce the payload size limit configured via Server::set payload max length() on decompressed request bodies when using HandlerWithContentReader with Content-Encoding: gzip or other supported encodings. A small compressed payload can expand beyond the configured limit, potentially leading to a denial of service through CPU or memory exhaustion.

Recommendations Update to version 0.35.0 or later.