yhirose cpp-httplib vulnerabilities

Latest yhirose cpp-httplib CVEs

Newest publication first · page 1 of 2

1. CVE-2026-103930 cpp-httplib open_stream serializes CRLF in request target into HTTP request line

   Published 2026-10-14

   Low·CVSS 3.7 EPSS 0.37%

   cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw...

2. CVE-2026-102944 cpp-httplib: Cookie header leaked on cross-origin redirect

   Published 2026-10-14

   High·CVSS 7.5 EPSS 0.43%

   cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies t...

3. CVE-2026-77358 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()

   Published 2026-08-27

   High·CVSS 8.2 EPSS 0.45%

   cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is fre...

4. CVE-2026-77341 cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing

   Published 2026-08-27

   Medium·CVSS 5.3 EPSS 0.46%

   cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split...

5. CVE-2026-54919 cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends

   Published 2026-07-10

   High·CVSS 7.4 EPSS 0.26%

   cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLF...

6. CVE-2026-45372 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

   Published 2026-05-29

   Critical·CVSS 9.9 EPSS 0.30%

   cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run befor...

7. CVE-2026-46527 cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash

   Published 2026-05-29

   High·CVSS 8.7 EPSS 0.33%

   cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose valu...

8. CVE-2026-45352 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding

   Published 2026-05-29

   High·CVSS 7.5 EPSS 0.33%

   cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses th...

9. CVE-2026-34441 cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body

   Published 2026-03-31

   Medium·CVSS 6.5 EPSS 0.20%

   cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.40.0, cpp-httplib is vulnerable to HTTP Request Smuggling. The server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connect...

10. CVE-2026-33745 cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect

    Published 2026-03-27

    High·CVSS 7.4 EPSS 0.27%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following cross-origin HTTP redirects (301/302/307/308). A...

11. CVE-2026-32627 cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy

    Published 2026-03-13

    High·CVSS 8.1 EPSS 0.20%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabl...

12. CVE-2026-31870 cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header

    Published 2026-03-11

    High·CVSS 7.5 EPSS 0.52%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value rec...

13. CVE-2026-29076 cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing

    Published 2026-03-07

    Medium·CVSS 5.9 EPSS 1.1%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtra...

14. CVE-2026-28435 Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib

    Published 2026-03-04

    High·CVSS 7.5 EPSS 0.48%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content...

15. CVE-2026-28434 cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header

    Published 2026-03-04

    Medium·CVSS 5.3 EPSS 0.35%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and wr...

16. CVE-2026-22776 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb

    Published 2026-01-12

    High·CVSS 8.7 EPSS 0.41%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library va...

17. CVE-2026-21428 cpp-httplib has CRLF injection in http headers

    Published 2026-01-01

    High·CVSS 7.7 EPSS 0.40%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the write_headers function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows...

18. CVE-2025-66577 cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust

    Published 2025-12-05

    Medium·CVSS 5.3 EPSS 0.29%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-...

19. CVE-2025-66570 cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)

    Published 2025-12-05

    Critical·CVSS 9.8 EPSS 0.35%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR,...

20. CVE-2025-53629 cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability

    Published 2025-07-10

    High·CVSS 7.5 EPSS 0.59%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in...

21. CVE-2025-53628 cpp-httplib does not limit the length of a line

    Published 2025-07-10

    Medium·CVSS 6.3 EPSS 0.52%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnera...

22. CVE-2025-52887 cpp-httplib has unlimited number of http header fields, which causes memory leak

    Published 2025-06-26

    High·CVSS 7.5 EPSS 0.49%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection...

23. CVE-2025-46728 cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests

    Published 2025-05-06

    High·CVSS 7.5 EPSS 0.68%

    cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Prior to version 0.20.1, the library fails to enforce configured size limits on incoming request bodies when Transfer-Encoding: chunked is used or when no Content-Length header is provided. A remote attacker c...

24. CVE-2025-0825 CRLF injection in Cpp-httplib

    Published 2025-02-04

    Medium·CVSS 6.9 EPSS 0.42%

    cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

25. CVE-2023-26130 Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete....

    Published 2023-05-30

    High·CVSS 8.8 EPSS 1.1%

    Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This iss...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.