cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.
References
| Link | Resource |
|---|---|
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m | Exploit Mitigation Vendor Advisory |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m | Exploit Mitigation Vendor Advisory |
Configurations
History
01 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m - Exploit, Mitigation, Vendor Advisory |
01 Jun 2026, 18:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m - Exploit, Vendor Advisory, Mitigation | |
| First Time |
Yhirose
Yhirose cpp-httplib |
|
| CPE | cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:* |
29 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-29 20:16
Updated : 2026-06-01 19:16
NVD link : CVE-2026-45372
Mitre link : CVE-2026-45372
CVE.ORG link : CVE-2026-45372
JSON object : View
Products Affected
yhirose
- cpp-httplib