Quick answers
- Is CVE-2026-45372 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45372 being exploited in the wild.
- How severe is CVE-2026-45372?
- Critical severity, with a CVSS score of 9.9, published 29 May 2026.
- Which products and versions are affected?
- Yhirose Cpp-Httplib < 0.44.0.
- Is there a fix for CVE-2026-45372?
- A patch was published on 2026-05-29: Fix released in version 0.44.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45372 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-45372?
- Check whether you run Yhirose Cpp-Httplib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A CRLF injection vulnerability exists in cpp-httplib's server-side header parsing logic. The library performs percent-decoding on most incoming header values (except Location and Referer) after initial validation has already occurred. Because the decoded values are not re-validated, an attacker can send encoded sequences like '%0D%0A' which bypass the 'is_field_value' check and are subsequently expanded into literal carriage return and line feed characters. This allows for HTTP response splitting, log injection, and request smuggling, especially when the library is used in proxy configurations. The vulnerability also enables bypasses of WAFs and reverse proxies that do not perform the same non-standard decoding (including %uXXXX sequences). The issue is fixed in version 0.44.0.
Affected products
- yhirose cpp-httplib < 0.44.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE published to NVD
- 2026-05-29: patched: Fix released in version 0.44.0