Back to overview

CVE-2026-45372

CRITICAL Exploitation: PoC
9.9
CVSS 3.1
Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

Metadata

CVE ID
CVE-2026-45372
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-12 00:51 UTC
Published
2026-05-29 19:21 UTC
Last updated
2026-06-01 17:57 UTC
Primary CWE
CWE-93
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Inj…
Vendor / Product
yhirose / cpp-httplib
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
yhirose cpp-httplib — < 0.44.0
Weakness (CWE)
CWESourceDescription
CWE-444 cna CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-93 cna CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
References (1)
Back to overview