CVE-2026-29076: 
Homebrew vulnerability analysis and mitigation

CVE-2026-29076 is a stack overflow denial-of-service vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. It affects all versions up to and including 0.35.0 that use std::regex (libstdc++) for RFC 5987 filename* parsing in multipart Content-Disposition headers. The vulnerability was published on March 7, 2026, and patched in version 0.37.0. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-674 (Uncontrolled Recursion) and CWE-1333 (Inefficient Regular Expression Complexity). The vulnerable code resides in httplib.h at FormDataParser::parse() (line 7774), where std::regex_match() is called with libstdc++'s backtracking regex engine to validate RFC 5987-encoded filename* values. The libstdc++ regex engine implements backtracking via deep recursion, consuming approximately 3 stack frames (~300 bytes each) per input character — meaning a filename* value of N characters consumes roughly N × 900 bytes of stack space. Since CPPHTTPLIB_HEADER_MAX_LENGTH defaults to 8192 bytes, an attacker can craft a filename* payload of up to ~8130 characters, generating approximately 7.3 MB of stack recursion and triggering a SIGSEGV crash. The fix in commit de296af replaces the std::regex-based Content-Disposition parser with a manual string-parsing implementation that avoids recursive backtracking entirely (GitHub Advisory, Patch Commit).

Successful exploitation causes the server process to crash with a SIGSEGV signal, resulting in complete denial of service for all in-flight requests across all threads. No authentication or user interaction is required, and a single HTTP POST request is sufficient to bring down the server. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue — but any application relying on cpp-httplib for file upload handling is exposed to immediate, repeatable service disruption (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, consisting of a Python script (send_exploit.py) and a vulnerable server example (server.cpp) that together demonstrate the crash. The PoC achieves denial of service (SIGSEGV) but not remote code execution. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.038% (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify services built with cpp-httplib versions ≤ 0.35.0 that expose HTTP endpoints accepting multipart/form-data uploads (e.g., file upload endpoints). No authentication is required.
2. Craft the malicious request: Construct an HTTP POST request with Content-Type: multipart/form-data and a multipart body containing a Content-Disposition header with a filename* parameter set to UTF-8'' followed by a long string (e.g., 8000+ repeated ASCII characters).
3. Ensure payload fits within header limit: Keep the Content-Disposition line under 8192 bytes (the default CPPHTTPLIB_HEADER_MAX_LENGTH). A payload of ~8000 characters is sufficient to overflow stacks of 4–8 MB.
4. Send the request: Transmit the crafted POST request to any multipart-accepting endpoint on the target server (e.g., POST /upload). No special tools are needed — a raw socket or curl suffices.
5. Observe crash: The server's std::regex_match() call recurses ~3 frames per character, exhausting the stack and triggering SIGSEGV. The server process terminates, dropping all active connections. The server must be manually restarted (GitHub Advisory).

• Network: Unexpected HTTP POST requests to file upload endpoints containing a Content-Disposition header with a filename*=UTF-8'' parameter followed by an unusually long string (hundreds to thousands of characters); single large POST requests from external IPs to endpoints not normally accessed.
• Logs: Web server or application logs showing a POST request immediately followed by no response or a connection reset; absence of a response log entry for a received request (server crashed before responding).
• Process: Sudden termination of the cpp-httplib server process with signal 11 (SIGSEGV); crash dump or core file generated in the server's working directory referencing std::regex_match or FormDataParser::parse in the stack trace.
• System: OS-level crash reports or dmesg entries indicating segmentation fault for the server process PID (GitHub Advisory).

The primary remediation is to upgrade cpp-httplib to version 0.37.0 or later, which replaces the vulnerable std::regex-based Content-Disposition parser with a manual string parser that does not use recursive backtracking (GitHub Release, Patch Commit). Fedora packages for Fedora 42, 43, and 44 have received updated builds, and openSUSE has also issued security updates. As a temporary workaround where patching is not immediately possible, operators can place a reverse proxy or WAF in front of the cpp-httplib server to reject or truncate multipart requests with abnormally long Content-Disposition header values, or restrict access to file upload endpoints to trusted networks only (Red Hat Bugzilla).

The vulnerability was credited to researcher DIABL0-SEC in the GitHub Security Advisory. Red Hat tracked the issue via Bugzilla and assessed it as medium severity. Fedora and openSUSE both issued package updates shortly after disclosure. Coverage appeared on Linux security news aggregators including linuxsecurity.com and linuxcompatible.org, and Tenable released Nessus detection plugins (IDs 301478, 303248, 303249) for the vulnerability (GitHub Advisory, Red Hat Bugzilla).