Executive brief
cpp-httplib is a widely used C++ library for adding web server and client functionality to applications. A security flaw in how it handles web request headers allows attackers to inject malicious commands or fake data into the communication stream. This could lead to unauthorized cookies being set, security filters being bypassed, or the hijacking of web sessions, potentially compromising user data and application integrity.
Technical details
A CRLF injection vulnerability exists in cpp-httplib's server-side header parsing logic. The library performs percent-decoding on most incoming header values (except Location and Referer) after initial validation has already occurred. Because the decoded values are not re-validated, an attacker can send encoded sequences like '%0D%0A' which bypass the 'is_field_value' check and are subsequently expanded into literal carriage return and line feed characters. This allows for HTTP response splitting, log injection, and request smuggling, especially when the library is used in proxy configurations. The vulnerability also enables bypasses of WAFs and reverse proxies that do not perform the same non-standard decoding (including %uXXXX sequences). The issue is fixed in version 0.44.0.
Affected products
- yhirose cpp-httplib < 0.44.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD
- 2026-05-29: patched: Fix released in version 0.44.0