CRLF Injection Vulnerability in cpp-httplib: Potential for HTTP Response Splitting and XSS
Summary
DEBIAN-CVE-2025-0825: cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. Affects cpp-httplib versions < 0.18.7-1. Fixed in 0.18.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a lightweight C++ HTTP/HTTPS server and client library designed for ease of use and performance. It allows developers to quickly implement HTTP functionalities in their applications. However, versions v0.17.3 through v0.18.3 are vulnerable to a CRLF injection issue, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from cpp-httplib's failure to properly filter CRLF (Carriage Return Line Feed) characters when they are prefixed with a null byte. This oversight allows attackers to exploit CRLF injection, potentially leading to HTTP Response Splitting, Cross-Site Scripting (XSS), and other malicious activities. The affected versions are v0.17.3 to v0.18.3, which can be exploited if the library is used in web applications that process user input without adequate validation.
How To Fix
Minimum fixed version
0.18.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cpp-httplibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all user inputs are properly sanitized and validated before being processed by the cpp-httplib library. This can help mitigate the risk of CRLF injection until the package is updated. For example, you can implement input validation like this: 'if (
input.contains("\r") || input.contains("\n")) { throw new IllegalArgumentException("Invalid input");
}'.
Conclusion
The CRLF injection vulnerability in cpp-httplib poses significant risks to applications using affected versions. It is crucial to update to the patched version 0.18.7-1 or later to ensure the security of your application. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for cpp-httplib →
FAQ
CRLF injection is a type of attack where an attacker inserts CRLF characters into an HTTP request, potentially altering the structure of the response and leading to security vulnerabilities.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your manifest file, you can determine if your application is affected by this vulnerability.
The risks include HTTP Response Splitting, which can lead to XSS attacks, cache poisoning, and other security issues that compromise user data and application integrity.
While the best solution is to update to a patched version, you can implement input validation as a temporary workaround to mitigate the risks associated with this vulnerability.
You can find more information about cpp-httplib on its official GitHub repository, where you can also track updates and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
