What’s Vulnerable › Vulnerabilities

CVE-2026-45372: cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-29 · updated 2026-07-22
• Weakness: CWE-93

Description

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

Affected products

• yhirose cpp-httplib: before 0.44.0 — fixed in 0.44.0

How to fix

Upgrade to a fixed version: yhirose cpp-httplib 0.44.0. Check the vendor advisory for mitigations.

References

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m

Get alerted when CVE-2026-45372 or the next vulnerability affects your stack