p PatchFirst

CVE-2023-26130

CVE-2023-26130

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).

CVSS 7.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • yhirose/cpp-httplib

    Versions
    • ≥ 0, < 0.12.4: Affected (semver)

    Update to 0.12.4

  • cpp-httplib Debian:12

    Versions
    • 0.11.4+ds-1
    Affected ranges
    • ECOSYSTEM: < 0.11.4+ds-1+deb12u1

    Update to 0.11.4+ds-1+deb12u1

  • cpp-httplib Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.11.4+ds-2

    Update to 0.11.4+ds-2

  • cpp-httplib Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.11.4+ds-2

    Update to 0.11.4+ds-2

  • cpp-httplib Ubuntu:Pro:22.04:LTS

    Versions
    • 0.9.9+ds-1
    • 0.9.10+ds-1
    • 0.10.1+ds-1
    • 0.10.2+ds-1
    • 0.10.3+ds-1
    • 0.10.3+ds-1ubuntu0.1~esm1
    • 0.10.3+ds-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →