CRLF Injection Vulnerability in cpp-httplib Package
Summary
UBUNTU-CVE-2025-0825: cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. Affects cpp-httplib versions 0.10.1+ds-1 – 0.9.9+ds-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cpp-httplib is a C++ library designed for HTTP/HTTPS communication, providing a simple and efficient way to create HTTP clients and servers. It is widely used in applications requiring network communication. The library's ease of use and lightweight nature make it a popular choice among developers. However, certain versions of cpp-httplib are vulnerable to a CRLF injection attack, which can compromise the integrity of HTTP responses.
Vulnerability Detail
The vulnerability identified as CVE-2025-0825 affects cpp-httplib versions v0.17.3 through v0.18.3. It fails to properly filter CRLF (Carriage Return Line Feed) characters when they are prefixed with a null byte. This oversight allows attackers to exploit CRLF injection, potentially leading to HTTP Response Splitting, Cross-Site Scripting (XSS), and other security issues. The flaw originates from inadequate input validation in the library's handling of HTTP headers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement input validation to sanitize user inputs and prevent CRLF characters from being processed. This can be done by checking for null bytes and filtering out any CRLF sequences before they are used in HTTP headers.
Conclusion
The CRLF injection vulnerability in cpp-httplib poses significant security risks, including potential HTTP Response Splitting and XSS attacks. It is crucial for users of affected versions to update to a patched version to ensure the security of their applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for cpp-httplib →
FAQ
CRLF injection is a type of attack that allows an attacker to insert CRLF characters into HTTP headers, potentially leading to various security vulnerabilities, including HTTP Response Splitting.
The affected versions are cpp-httplib v0.17.3 through v0.18.3. Users should upgrade to version 0.18.4 or later to mitigate the risk.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without any installation.
Exploiting this vulnerability can lead to HTTP Response Splitting, which may allow attackers to inject malicious content, perform XSS attacks, or manipulate HTTP responses.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities. You can check your application against known vulnerabilities using their playground without signing up.
References
Related vulnerabilities
Recent vulnerabilities recorded for cpp-httplib.
