CVE-2026-29076
Reported by github_m · Published March 7, 2026
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| cpp-httplib | yhirose | 0.37.0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| yhirose | cpp-httplib | < 0.37.0 |
| yhirose | cpp-httplib | 0 |
Timeline
- Mar 7, 2026 CVE Published
- Mar 8, 2026 EPSS Score (30 in total, the first dated here)
- Mar 9, 2026 CVE Updated
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 20, 2026 PoC Published
- Oct 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-29076
vulnetix vdb fixes CVE-2026-29076Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-29076/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart