The cpp-httplib C++11 header-only HTTP/HTTPS library versions before 0.43.4 improperly validate the chunk-size field in HTTP chunked transfer encoding. The function ChunkedDecoder::read_payload uses std::strtoul() to parse chunk sizes, which per C standard accepts a leading minus sign and performs unsigned wrap-around. While the library rejects the value for "-1", other negative values like "-2" pass validation, resulting in a near-maximum unsigned value being assigned to chunk_remaining. This causes the server to allocate excessive memory and potentially crash during the read loop. The vulnerability is addressed in version 0.43.4.

An attacker can send a chunked HTTP request with a negative chunk-size (other than "-1") that passes validation and causes the server to allocate an extremely large amount of memory. This leads to unbounded memory allocation and a denial of service via process crash. There is no impact on confidentiality or integrity reported. The CVSS score is 5.3 (medium severity) reflecting a network attack vector, no privileges required, no user interaction, and impact limited to availability.

Upgrade to cpp-httplib version 0.43.4 or later where this vulnerability is fixed. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is resolved in 0.43.4. No other mitigations are indicated.