{"kind": "product", "path": "vulns/ubuntu-26.10/cpp-httplib", "name": "cpp-httplib", "product": "cpp-httplib", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-103930", "noindex": false, "published": "2026-10-14T18:19:38.256Z", "modified": "2026-10-15T15:06:40.241Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00366, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-103930", "title": "cpp-httplib open_stream serializes CRLF in request target into HTTP request line", "description": "cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr", "https://github.com/yhirose/cpp-httplib/pull/2501", "https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-102944", "noindex": false, "published": "2026-10-14T18:18:21.598Z", "modified": "2026-10-15T14:48:03.087Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00434, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102944", "title": "cpp-httplib: Cookie header leaked on cross-origin redirect", "description": "cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue i", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv", "https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-77358", "noindex": false, "published": "2026-08-27T22:37:14.339Z", "modified": "2026-08-31T18:25:37.895Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00445, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77358", "title": "cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()", "description": "cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close the SSL object is freed and the pointer cleared, but the subsequent WebSocket close still sends a close frame through the SSL socket stream, which holds a raw copy of the now-dangling session pointer and reads from and writes to the freed memory. The same freed-then-used ordering is reachable through the client's destructor and its connect path, so ordinary teardown of a secure WebSocket ", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-w7p7-f35j-mw7q", "https://github.com/yhirose/cpp-httplib/commit/2f986fd5e56e7c5f686d965174516360930f371d", "https://nvd.nist.gov/vuln/detail/CVE-2026-77358"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-77341", "noindex": false, "published": "2026-08-27T22:16:45.356Z", "modified": "2026-08-28T15:30:02.142Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77341", "title": "cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing", "description": "cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP response. Unlike every other header-writing path in the library, the trailer-writing code applies none of the field-name and field-value checks that reject carriage return and line feed, so an application that places attacker-influenced data into a chunked response trailer emits attacker-controlled CRLF onto the wire. This enables HTTP response splitting, le", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-2r2h-jc8w-w66c", "https://github.com/yhirose/cpp-httplib/commit/568d434e72fc51729d0ad33abffb181e5f7a453d", "https://nvd.nist.gov/vuln/detail/CVE-2026-77341"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-54919", "noindex": false, "published": "2026-07-10T16:06:12.848Z", "modified": "2026-07-14T03:55:43.419Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00264, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-54919", "title": "cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Client in HTTPS mode skip certificate chain validation and WebSocketClient on the Mbed TLS backend skips verification altogether, allowing a man-in-the-middle attacker positioned to intercept traffic to present a crafted certificate and read or modify th", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8ffh-4p95-g3p2", "https://github.com/yhirose/cpp-httplib/commit/fa981cedae004ea9d946f1392b9dec22fac6fee6", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.47.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-45372", "noindex": false, "published": "2026-05-29T19:21:12.313Z", "modified": "2026-06-01T17:57:44.116Z", "cvss": 9.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "severity": "critical", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45372", "title": "cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \\r\\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4m", "https://nvd.nist.gov/vuln/detail/CVE-2026-45372"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-46527", "noindex": false, "published": "2026-05-29T19:18:26.615Z", "modified": "2026-06-01T13:52:30.508Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00327, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46527", "title": "cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, When the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service). With Sanitizers enabled, you get an explicit runtime diagnostic. This vulnerability is fixed in 0.44.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-hg3g-vrg8-578g", "https://nvd.nist.gov/vuln/detail/CVE-2026-46527"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-45352", "noindex": false, "published": "2026-05-29T19:14:08.065Z", "modified": "2026-06-02T01:52:12.106Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00327, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45352", "title": "cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib (httplib.h) parses the chunk-size field of HTTP chunked transfer encoding using std::strtoul(). Per the C standard (§7.22.1.4), strtoul silently accepts a leading minus sign, performing unsigned wrap-around: strtoul(\"-2\", …, 16) returns ULONG_MAX − 1 (0xFFFFFFFFFFFFFFFE). The library's only guard (line 12833) rejects ULONG_MAX (the result of \"-1\"), but any other negative value such as \"-2", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h6wq-j5mv-f3q8", "https://nvd.nist.gov/vuln/detail/CVE-2026-45352"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-34441", "noindex": false, "published": "2026-03-31T21:21:33.197Z", "modified": "2026-04-01T15:53:07.782Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00196, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-34441", "title": "cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.40.0, cpp-httplib is vulnerable to HTTP Request Smuggling. The server's static file handler serves GET responses without consuming the request body. On HTTP/1.1 keep-alive connections, the unread body bytes remain on the TCP stream and are interpreted as the start of a new HTTP request. An attacker can embed an arbitrary HTTP request inside the body of a GET request, which the server processes as a separate request. This issue has been patched in version 0.40.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-jv63-rm9j-6jwc", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.40.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-34441"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-33745", "noindex": false, "published": "2026-03-27T00:46:48.941Z", "modified": "2026-04-01T03:55:22.387Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00266, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-33745", "title": "cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.39.0, the cpp-httplib HTTP client forwards stored Basic Auth, Bearer Token, and Digest Auth credentials to arbitrary hosts when following cross-origin HTTP redirects (301/302/307/308). A malicious or compromised server can redirect the client to an attacker-controlled host, which then receives the plaintext credentials in the `Authorization` header. Version 0.39.0 fixes the issue.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-6hrp-7fq9-3qv2", "https://nvd.nist.gov/vuln/detail/CVE-2026-33745"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-32627", "noindex": false, "published": "2026-03-13T20:48:14.442Z", "modified": "2026-03-16T15:41:05.578Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-32627", "title": "cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target — expired, self-signed, or forged — without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulner", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-c3h8-fqq4-xm4g", "https://nvd.nist.gov/vuln/detail/CVE-2026-32627"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-31870", "noindex": false, "published": "2026-03-11T17:57:49.744Z", "modified": "2026-03-12T20:10:21.550Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-31870", "title": "cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses the streaming API (httplib::stream::Get, httplib::stream::Post, etc.), the library calls std::stoull() directly on the Content-Length header value received from the server with no input validation and no exception handling. std::stoull throws std::invalid_argument for non-numeric strings and std::out_of_range for values exceeding ULLONG_MAX. Since nothing catches these exceptions, the C++ runtime calls std::terminate(), which kills the process with SIGABRT. Any server the client connects to — including servers reac", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-39q5-hh6x-jpxx", "https://nvd.nist.gov/vuln/detail/CVE-2026-31870"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-29076", "noindex": false, "published": "2026-03-07T16:08:56.048Z", "modified": "2026-03-09T18:25:58.815Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00639, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-29076", "title": "cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multipart Content-Disposition headers. The regex engine in libstdc++ implements backtracking via deep recursion, consuming one stack frame per input character. An attacker can send a single HTTP POST request with a crafted filename* parameter that causes uncontrolled stack growth, resulting in a stack overflow (SIGSEGV) that crashes the server process. This issue has been patched in version 0.37.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qq6v-r583-3h69", "https://github.com/yhirose/cpp-httplib/commit/de296af3eb5b0d5c116470e033db900e4812c5e6", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-28435", "noindex": false, "published": "2026-03-04T19:36:33.418Z", "modified": "2026-03-04T20:39:46.131Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00435, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28435", "title": "Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (streaming ContentReader) with Content-Encoding: gzip (or other supported encodings). A small compressed payload can expand beyond the configured payload limit and be processed by the application, enabling a payload size limit bypass and potential denial of service (CPU/memory exhaustion). This vulnerability is fixed in 0.35.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xvfx-w463-6fpp", "https://github.com/yhirose/cpp-httplib/commit/c99d7472b5cf4869d3897b9afc9792063a3d15a8", "https://nvd.nist.gov/vuln/detail/CVE-2026-28435"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-28434", "noindex": false, "published": "2026-03-04T19:34:30.486Z", "modified": "2026-03-04T20:55:40.320Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-28434", "title": "cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages ", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-8mpw-r4gc-xm7q", "https://github.com/yhirose/cpp-httplib/commit/defd907c7469c5c8281247b73bbd07be24c31164", "https://nvd.nist.gov/vuln/detail/CVE-2026-28434"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-22776", "noindex": false, "published": "2026-01-12T18:18:01.527Z", "modified": "2026-01-12T18:49:59.317Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00414, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-22776", "title": "cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS) vulnerability exists in cpp-httplib due to the unsafe handling of compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The library validates the payload_max_length against the compressed data size received from the network, but does not limit the size of the decompressed data stored in memory.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-h934-98h4-j43q", "https://github.com/yhirose/cpp-httplib/commit/2e2e47bab1ae6a853476eecbc4bf279dd1fef792", "https://nvd.nist.gov/vuln/detail/CVE-2026-22776"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-21428", "noindex": false, "published": "2026-01-01T17:54:43.959Z", "modified": "2026-01-02T18:50:20.380Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "severity": "high", "epss": 0.00404, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-21428", "title": "cpp-httplib has CRLF injection in http headers", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers`` function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines.\nThis vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-wpc6-j37r-jcx7", "https://github.com/yhirose/cpp-httplib/commit/98048a033a532ff22320ce1d11789f8d5710dfcd", "https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-66577", "noindex": false, "published": "2025-12-05T18:20:25.852Z", "modified": "2025-12-05T18:29:10.535Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00274, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-66577", "title": "cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-gfpf-r66f-5mh2", "https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff", "https://nvd.nist.gov/vuln/detail/CVE-2025-66577"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2025-66570", "noindex": false, "published": "2025-12-05T18:18:02.928Z", "modified": "2025-12-05T18:40:09.318Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "critical", "epss": 0.00336, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-66570", "title": "cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*)", "description": "cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the c", "references": ["https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xm2j-vfr9-mg9m", "https://github.com/yhirose/cpp-httplib/commit/ac9ebb0ee333ce8bf13523f487bdfad9518a2aff", "https://nvd.nist.gov/vuln/detail/CVE-2025-66570"], "fixes": [], "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "cpp-httplib", "path": "vulns/ubuntu-26.10/cpp-httplib", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 2, "kev": 0}, "lastmod": "2026-10-15T15:06:40.241Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}