CRLF Injection Vulnerability in cpp-httplib: Risk of HTTP Response Splitting and XSS
Summary
CVE-2025-0825: cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. Affects cpp-httplib across 2 version ranges.
< 9c36aae4b73e2b6e493f4133e4173103c9266289
>= 61c418048d8b0e42cc55e908c1c2da1e2f617f86, < 54f8a4d0f34acb3cc508e337d9881296b70201ad
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ header-only library designed for HTTP/HTTPS requests. It is lightweight and easy to integrate, making it popular for developers needing a simple way to handle HTTP communications. However, versions v0.17.3 through v0.18.3 have a critical vulnerability that allows for CRLF injection, which can compromise the integrity of HTTP responses.
Vulnerability Detail
The vulnerability arises from cpp-httplib's failure to properly filter CRLF (Carriage Return Line Feed) characters when they are prefixed with a null byte. This oversight can be exploited by attackers to inject malicious content into HTTP responses, potentially leading to HTTP Response Splitting attacks. Such attacks can facilitate further exploits, including Cross-Site Scripting (XSS), which can compromise user data and application security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to filter out CRLF characters in user inputs before processing them. This can be done using the following code snippet: 'if (
input.contains("\r") || input.contains("\n")) { throw new Exception("Invalid input");
}'. This will help mitigate the risk until the package is updated.
Conclusion
The CRLF injection vulnerability in cpp-httplib poses significant risks to applications using affected versions. It is essential to update to the patched version to safeguard against potential exploits. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for cpp-httplib →
FAQ
CRLF injection is a type of attack where an attacker injects CRLF characters into a response header, allowing them to manipulate the response structure.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
Exploiting this vulnerability can lead to HTTP Response Splitting, which may allow attackers to perform XSS attacks, steal user data, or redirect users to malicious sites.
Yes, a patch is available in the form of an updated version of cpp-httplib. Ensure you update to the version that includes the fix.
If immediate updates are not possible, implement input validation as a temporary workaround to mitigate the risk of CRLF injection.
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
