Critical Vulnerability in cpp-httplib: Header Parsing Flaw Allows Injection Attacks
Summary
DEBIAN-CVE-2026-45372: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Affects cpp-httplib versions 0.11.4+ds-1 – 0.41.0+ds-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cpp-httplib is a C++11 single-file header-only cross-platform HTTP/HTTPS library designed for ease of use and integration into various applications. It provides a simple interface for handling HTTP requests and responses, making it popular among developers for building web servers and clients. However, prior to version 0.44.0, cpp-httplib had a significant vulnerability in its header parsing mechanism, which could lead to security risks if exploited.
Vulnerability Detail
The vulnerability arises from cpp-httplib's server incorrectly handling percent-decoding of header values. Specifically, while it applies percent-decoding to most headers, it excludes the Location and Referer headers. This oversight allows encoded sequences like %0D%0A to pass validity checks and be expanded into literal carriage return and newline byte pairs within the stored header values. This flaw can be exploited to perform injection attacks, potentially compromising the integrity of the application and leading to unauthorized access or data manipulation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks on incoming header values to filter out potentially harmful sequences before they are processed by cpp-httplib. However, this is not a substitute for updating to the patched version.
Conclusion
The cpp-httplib library has a critical vulnerability related to its header parsing mechanism, which could allow for injection attacks. It is crucial for developers using this library to update to version 0.44.0 or later to mitigate the risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for cpp-httplib →
FAQ
cpp-httplib is a C++ library that provides a simple interface for creating HTTP/HTTPS servers and clients.
Versions prior to 0.44.0 are affected by this vulnerability.
Exploitation of this vulnerability could lead to injection attacks, compromising application integrity and security.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 9.9, indicating a critical level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
