CVE-2026-29076
Description
A flaw was found in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP POST request with a malicious filename* parameter in the Content-Disposition header. This triggers uncontrolled stack growth due to the std::regex engine's deep recursion, leading to a stack overflow and causing the server process to crash, resulting in a Denial of Service (DoS).
Statement
The vulnerability CVE-2026-29076 is of MODERATE impact. It affects applications utilizing the cpp-httplib library to parse multipart Content-Disposition headers, specifically when handling filename* values. A remote attacker can send a crafted HTTP POST request, leading to a stack overflow and denial of service in the server process. This issue primarily impacts services that accept and process such multipart requests.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
