CVE-2025-52887: 
Homebrew vulnerability analysis and mitigation

CVE-2025-52887 is an uncontrolled resource consumption vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. In version 0.21.0, the library's read_headers function does not limit the number of HTTP header fields that can be processed, and memory allocated for those headers is not released when the connection is disconnected, enabling memory exhaustion attacks. The vulnerability was published on June 26, 2025, and a patch was released in version 0.22.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). The vulnerable read_headers function in httplib.h enforces a maximum size per individual header line (via CPPHTTPLIB_HEADER_MAX_LENGTH) but imposes no limit on the total number of headers or their cumulative memory footprint. An attacker can open a TCP connection, send an initial HTTP request line, and then continuously stream arbitrary custom header fields (e.g., X-Custom-Header-N: <value>) without ever sending the terminating \r\n\r\n sequence, causing the server to indefinitely allocate memory into an unordered_multimap structure. This attack path is pre-authentication and requires no special privileges. The fix in version 0.22.0 introduces a CPPHTTPLIB_HEADER_MAX_COUNT constant (defaulting to 100) that terminates header parsing once the limit is reached (GitHub Advisory, GitHub Commit).

Successful exploitation results in a Denial of Service (DoS) through memory exhaustion, causing the server process to crash or become completely unresponsive. There is no confidentiality or integrity impact — the vulnerability is limited to availability. On multi-tenant or shared systems, the memory exhaustion can spill over and degrade or crash other co-located applications and services (GitHub Advisory).

A proof-of-concept exploit script (Python client) is publicly available in the GitHub Security Advisory, demonstrating the slow-headers attack technique. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network, making it trivially weaponizable. The EPSS score is 0.0004, indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify services built with cpp-httplib version 0.21.0 by scanning for open HTTP ports and fingerprinting server behavior or reviewing open-source project dependencies.
2. Establish TCP connection: Open a raw TCP socket connection to the target server's HTTP port (e.g., port 8080).
3. Send initial HTTP request line: Transmit only the request line (e.g., GET / HTTP/1.1\r\n) without completing the headers, keeping the connection open.
4. Stream unlimited headers: Continuously send unique custom HTTP header lines (e.g., X-Custom-Header-1: XXXX...\r\n, X-Custom-Header-2: XXXX...\r\n, ...) without ever sending the terminating blank line (\r\n\r\n), forcing the server to allocate memory for each header.
5. Sustain the attack: Maintain the connection and continue sending headers; the server allocates memory into an unordered_multimap indefinitely without releasing it.
6. Achieve DoS: After sufficient headers are sent, the server process exhausts available system memory, resulting in a crash or complete unresponsiveness (GitHub Advisory).

• Network: Long-lived TCP connections to the HTTP service port that never complete a full HTTP request (no \r\n\r\n terminator observed); high volume of inbound connections from a single or small set of source IPs sending only partial HTTP data.
• Process/System: Rapid and sustained growth in memory consumption of the cpp-httplib server process without a corresponding increase in legitimate request throughput; OOM (Out-of-Memory) killer events in system logs targeting the server process.
• Logs: Server access logs showing connections that are established but never produce a completed request entry; application logs showing abrupt termination or crash of the HTTP server process.
• File System: Core dump files generated by the server process crash, potentially timestamped around the attack period (GitHub Advisory).

Upgrade cpp-httplib to version 0.22.0 or later, which introduces the CPPHTTPLIB_HEADER_MAX_COUNT limit (defaulting to 100 headers) in the read_headers function, preventing unbounded memory allocation. As a workaround prior to upgrading, operators can place a reverse proxy (e.g., nginx, HAProxy) in front of the cpp-httplib server configured to enforce header count and request timeout limits. Additionally, network-level controls such as connection rate limiting and idle connection timeouts can reduce exposure. The patch commit is available at the official repository (GitHub Commit, GitHub Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2374970) and assigned it medium severity, reflecting its impact on availability without privilege escalation. The vulnerability was reported by a researcher credited as "WhereIsOops" in the GitHub Security Advisory. Social media activity was limited to automated vulnerability feed posts on Mastodon and security aggregator platforms shortly after disclosure (Red Hat Bugzilla, GitHub Advisory).