What’s Vulnerable › Products
yhirose cpp-httplib vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.
Check whether your yhirose cpp-httplib version is affected
Latest yhirose cpp-httplib vulnerabilities
- CVE-2026-103930 — cpp-httplib open_stream serializes CRLF in request target into HTTP request line (CVSS 3.7)
- CVE-2026-102944 — cpp-httplib: Cookie header leaked on cross-origin redirect (CVSS 7.5)
- CVE-2026-77358 — cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() (CVSS 8.2)
- CVE-2026-77341 — cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing (CVSS 5.3)
- CVE-2026-54919 — cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends (CVSS 7.4)
- CVE-2026-46527 — cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash (CVSS 7.5)
- CVE-2026-45372 — cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection (CVSS 9.9)
- CVE-2026-45352 — cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding (CVSS 7.5)
- CVE-2026-34441 — cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body (CVSS 6.5)
- CVE-2026-33745 — cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect (CVSS 7.4)
- CVE-2026-32627 — cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy (CVSS 8.1)
- CVE-2026-31870 — cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header (CVSS 7.5)
- CVE-2026-29076 — cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing (CVSS 5.9)
- CVE-2026-28435 — Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib (CVSS 7.5)
- CVE-2026-28434 — cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (CVSS 5.3)
- CVE-2026-22776 — cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb (CVSS 7.5)
- CVE-2026-21428 — cpp-httplib has CRLF injection in http headers (CVSS 7.5)
- CVE-2025-66577 — cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust (CVSS 5.3)
- CVE-2025-66570 — cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) (CVSS 9.8)
- CVE-2025-53629 — cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability (CVSS 7.5)
- CVE-2025-53628 — cpp-httplib does not limit the length of a line (CVSS 8.8)
- CVE-2025-52887 — cpp-httplib has unlimited number of http header fields, which causes memory leak (CVSS 7.5)
- CVE-2025-0825 — CRLF injection in Cpp-httplib (CVSS 5.3)
- CVE-2020-11709 — (CVSS 7.5)