CVE-2026-45372

Katalog CVE

CVSS 9.9 · Critical EPSS 0,41%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada yhirose cpp-httplib. Skor CVSS 3.1 9.9 (Critical) menurut github.com.

Deskripsi (NVD)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

Rincian

Terbit di NVD

29 Mei 2026

Terakhir diubah

22 Juli 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m exploit · mitigasi · advisory vendor