CVE-2026-22776
Description
A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. A remote attacker can exploit this vulnerability by sending a specially crafted compressed HTTP request. While the library checks the size of the compressed data, it does not properly limit the size of the data after decompression, leading to excessive memory consumption. This can result in a Denial of Service (DoS), making the affected system unavailable.
Statement
This vulnerability is rated Important for Red Hat because it can lead to a denial of service in applications utilizing the cpp-httplib library to process compressed HTTP request bodies. The flaw occurs due to the library's failure to limit the size of decompressed data, allowing a small compressed payload to consume excessive memory.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
