CVE-2025-0825
CVE-2025-0825 · CRLF injection in Cpp-httplib
This page contains facts from public vulnerability sources. Check the original advisory before updating.
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
CVSS 6.9 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cpp-httplib Debian:12
- Versions
- 0.11.4+ds-1
- 0.11.4+ds-1+deb12u1
- 0.11.4+ds-2
- 0.11.4+ds-3
- 0.13.1+ds-1
- 0.14.0+ds-1
- 0.14.1+ds-1
- 0.14.1+ds-2
- 0.14.2+ds-1
- 0.14.3+ds-1
- 0.14.3+ds-1.1
- 0.14.3+ds-1.1~exp1
- 0.15.3+ds-1
- 0.15.3+ds-2
- 0.15.3+ds-3
- 0.16.0+ds-1
- 0.16.3+ds-1
- 0.16.3+ds-2
- 0.18.0+ds-1
- 0.18.7-1
- 0.20.1+ds-3
- 0.25.0+ds-1
- 0.26.0+ds-2
- 0.41.0+ds-1
- 0.41.0+ds-2
- 0.41.0+ds-3
- 0.41.0+ds-3~bpo13+1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cpp-httplib Debian:13
- Affected ranges
- ECOSYSTEM: < 0.18.7-1
Update to 0.18.7-1
cpp-httplib Debian:14
- Affected ranges
- ECOSYSTEM: < 0.18.7-1
Update to 0.18.7-1