Path Injection Vulnerability in cpp-httplib: Risk of HTTP Request Manipulation
Summary
DEBIAN-CVE-2026-103930: cpp-httplib is a C++ header-only HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3~bpo13+1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for HTTP/HTTPS communication. It provides a simple interface for making requests and handling responses, making it popular among developers for its ease of use and lightweight nature. However, versions 0.29.0 to 0.51.0 are vulnerable to a path injection issue that can lead to unauthorized manipulation of HTTP request metadata.
Vulnerability Detail
The vulnerability arises from the Client::open_stream function in httplib.h, which allows a caller-controlled path to bypass the detail::encode_path() protection. This oversight can lead to raw carriage-return and line-feed bytes being included in the outbound HTTP/1.1 request line, enabling attackers to inject malicious request metadata. Exploitation requires that an application passes user input directly into the open_stream path, and that a backend or intermediary interprets these injected bytes. The primary impact is the modification of backend-visible request data, rather than direct confidentiality or availability issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid passing unvalidated user input directly into the open_stream function. Implement input validation to sanitize paths before they are used in HTTP requests.
Conclusion
In summary, the cpp-httplib library has a vulnerability that allows for path injection, which can lead to the manipulation of HTTP request metadata. It is crucial to update to the patched version 0.51.0 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for cpp-httplib →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a moderate level of risk.
Versions 0.29.0 to 0.51.0 of cpp-httplib are affected by this vulnerability.
The vulnerability can lead to unauthorized modification of backend-visible request data, potentially affecting application behavior.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
