Read the docs
TI-2026-74410 Aliases CVE-2026-103930

CRLF injection in cpp-httplib open_stream alters HTTP request lines

Priority LOW 18CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

cpp-httplib from 0.29.0 before 0.51.0 is affected. Client::open_stream does not encode the caller-supplied path, so raw carriage return and line feed bytes can split the outbound HTTP/1.1 request line (CWE-113). A remote attacker who controls that input can inject request metadata that a backend or intermediary interprets, changing backend-visible request data with limited integrity impact. The embedding application must pass remote user input into open_stream for this to occur.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed cpp-httplib (yhirose): 0.51.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yhirosecpp-httplib0.29.0 to before 0.51.00.51.0Patch availableCNA
  • cpp-httplib Vendoryhirose Affected 0.29.0 to before 0.51.0 Fixed in 0.51.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*——yhirose
  • cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* Versions — — ·yhirose

Remediation

Upgrade cpp-httplib to version 0.51.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA cpp-httplib (yhirose) Fixed in 0.51.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-103930
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat

References

Other 4

  • TI-2026-33163 cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVSS 3.1CRITICAL 9.9
  • TI-2026-53978 cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() CVSS 4.0HIGH 8.2
  • TI-2026-18294 cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVSS 4.0HIGH 8.7
  • TI-2026-17313 cpp-httplib has CRLF injection in http headers CVSS 4.0HIGH 7.7
  • TI-2026-74409 cpp-httplib leaks Cookie headers on cross-origin redirect CVSS 3.1HIGH 7.5
  • TI-2026-33146 cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences