CVE-2026-45372
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The cpp-httplib library before version 0.44.0 improperly validates HTTP headers, allowing injection of newline characters via encoded header values.
Risk Assessment
An attacker can manipulate server responses or inject malicious headers, leading to HTTP response splitting attacks.
Recommendation
Update cpp-httplib to version 0.44.0 or later, which includes the fix.
Original NVD description (English source)
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.