« Volver al listado

CVE-2026-31870

Estado: AnalizadaAlta (7.5)—

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT.

Leer descripción completaMostrar menos

Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N permite explotación remota sin privilegios (T1190). El servidor malicioso envía Content-Length inválido causando crash por excepción no capturada (T1499.004 - DoS por aplicación).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Yhirose — Cpp-httplib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-31870",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-31870",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-12T20:10:14.440555Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "yhirose",
          "product": "cpp-httplib",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.37.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-11T18:16:26.487",
  "references": [
    {
      "url": "https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reached via HTTP redirects, third-party APIs, or man-in-the-middle positions can crash the client application with a single HTTP response. No authentication is required. No interaction from the end user is required. The crash is deterministic and immediate. This vulnerability is fixed in 0.37.1."
    },
    {
      "lang": "es",
      "value": "cpp-httplib es una biblioteca HTTP/HTTPS multiplataforma de un solo archivo y solo de cabecera para C++11. Antes de la versión 0.37.1, cuando un cliente cpp-httplib utiliza la API de streaming (httplib::stream::Get, httplib::stream::Post, etc.), la biblioteca llama directamente a std::stoull() sobre el valor del encabezado Content-Length recibido del servidor sin validación de entrada y sin manejo de excepciones. std::stoull lanza std::invalid_argument para cadenas no numéricas y std::out_of_range para valores que exceden ULLONG_MAX. Dado que nada captura estas excepciones, el tiempo de ejecución de C++ llama a std::terminate(), lo que termina el proceso con SIGABRT. Cualquier servidor al que se conecte el cliente —incluidos los servidores alcanzados a través de redirecciones HTTP, APIs de terceros o posiciones de man-in-the-middle— puede bloquear la aplicación cliente con una única respuesta HTTP. No se requiere autenticación. No se requiere interacción del usuario final. El bloqueo es determinista e inmediato. Esta vulnerabilidad se corrige en la versión 0.37.1."
    }
  ],
  "lastModified": "2026-06-17T10:34:40.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FC168D9-1A5B-44C8-BE39-60BA37CFA451",
              "versionEndExcluding": "0.37.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}