Vulnerability in Yhirose Cpp-Httplib
CVE-2026-45372
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.
Vulnerability class: CRLF Injection
EPSS: 0.003 (21.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L.
Affected products
- Yhirose Cpp-httplib — versions < 0.44.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-45372?
- CVE-2026-45372 is a critical-severity vulnerability in Yhirose Cpp-Httplib, classified under CRLF Injection. CVSS score: 9.9/10. Published 2026-05-29.
- How severe is CVE-2026-45372?
- Critical severity. CVSS v3 base score is 9.9 out of 10.