CVE-2026-28435 affects cpp-httplib, a widely used C++11 single-header HTTP/HTTPS library, in versions before 0.35.0. The vulnerability arises because the library fails to enforce the configured maximum payload size limit on decompressed HTTP request bodies when the HandlerWithContentReader is used in conjunction with compressed content encodings such as gzip. Specifically, while the library enforces Server::set_payload_max_length() on raw payload sizes, it does not apply this limit after decompression. This allows an attacker to send a small compressed payload that decompresses into a much larger payload, bypassing size restrictions. The consequence is uncontrolled resource consumption—CPU cycles and memory—potentially leading to denial of service conditions. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. The flaw is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-409 (Improper Synchronization), indicating potential concurrency issues exacerbating resource exhaustion. The vulnerability was publicly disclosed in March 2026 and fixed in cpp-httplib version 0.35.0. No known exploits are currently reported in the wild, but the ease of exploitation and impact warrant urgent attention.

This vulnerability can significantly impact organizations using cpp-httplib versions prior to 0.35.0 in their software stacks, especially those exposing HTTP/HTTPS services to untrusted networks. Attackers can exploit the flaw to cause denial of service by exhausting server CPU and memory resources through crafted compressed payloads that bypass size limits. This can lead to service outages, degraded performance, and increased operational costs due to resource overuse. Systems relying on cpp-httplib for critical services may experience downtime, affecting availability and potentially causing cascading failures in dependent systems. Since no authentication or user interaction is required, the attack surface is broad, and automated exploitation attempts could be feasible. Organizations with high-availability requirements or those operating in sectors such as finance, healthcare, or critical infrastructure may face heightened risks. Additionally, the vulnerability could be leveraged as part of multi-stage attacks to distract or disable defenses.

The primary mitigation is to upgrade cpp-httplib to version 0.35.0 or later, where the vulnerability is fixed by enforcing payload size limits on decompressed content. Until upgrading is possible, organizations should implement strict network-level controls such as rate limiting, deep packet inspection, and filtering of suspicious compressed HTTP requests to limit potential abuse. Application-level mitigations include adding custom decompression size checks before processing payloads and employing resource quotas or timeouts on request handling threads to prevent resource exhaustion. Monitoring for abnormal CPU and memory usage patterns related to HTTP request processing can help detect exploitation attempts early. Additionally, consider isolating services using cpp-httplib in containerized or sandboxed environments to limit impact. Regularly review and update dependencies to incorporate security patches promptly.