Yhirose Cpp-httplib vulnerabilities

• yhirose cpp-httplib cpp-httplib open_stream serializes CRLF in request target into HTTP request line CVE-2026-103930 3.7 LowOctober 14, 2026
• yhirose cpp-httplib cpp-httplib: Cookie header leaked on cross-origin redirect CVE-2026-102944 Fix available 7.5 HighOctober 14, 2026
• yhirose cpp-httplib cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() CVE-2026-77358 Fix available 8.2 HighAugust 27, 2026
• yhirose cpp-httplib cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing CVE-2026-77341 Fix available 5.3 MediumAugust 27, 2026
• yhirose cpp-httplib cpp-httplib: TLS certificate chain verification bypassed for IP-literal hosts on Mbed TLS and wolfSSL backends CVE-2026-54919 7.4 HighJuly 10, 2026
• yhirose cpp-httplib cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection CVE-2026-45372 Fix available 9.9 CriticalMay 29, 2026
• yhirose cpp-httplib cpp-httplib: Malicious `X-Forwarded-For` Under Trusted-Proxy Configuration Triggers Empty `vector::front()`, Leading to Undefined Behavior and Server Crash CVE-2026-46527 8.7 HighMay 29, 2026
• yhirose cpp-httplib cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding CVE-2026-45352 5.3 MediumMay 29, 2026
• yhirose cpp-httplib cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body CVE-2026-34441 Fix available 4.8 MediumMarch 31, 2026
• yhirose cpp-httplib cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect CVE-2026-33745 Fix available 7.4 HighMarch 27, 2026
• yhirose cpp-httplib cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy CVE-2026-32627 Fix available 8.7 HighMarch 13, 2026
• yhirose cpp-httplib cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header CVE-2026-31870 Fix available 7.5 HighMarch 11, 2026
• yhirose cpp-httplib cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing CVE-2026-29076 Fix available 5.9 MediumMarch 7, 2026
• yhirose cpp-httplib Payload size limit bypass via gzip decompression in ContentReader (streaming) allows oversized request bodies in cpp-httplib CVE-2026-28435 Fix available 7.5 HighMarch 4, 2026
• yhirose cpp-httplib cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header CVE-2026-28434 Fix available 5.3 MediumMarch 4, 2026
• yhirose cpp-httplib cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb CVE-2026-22776 Fix available 8.7 HighJanuary 12, 2026
• yhirose cpp-httplib cpp-httplib has CRLF injection in http headers CVE-2026-21428 Fix available 7.7 HighJanuary 1, 2026
• yhirose cpp-httplib cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust CVE-2025-66577 Fix available 5.3 MediumDecember 5, 2025
• yhirose cpp-httplib cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE*/LOCAL*) CVE-2025-66570 Fix available 10.0 CriticalDecember 5, 2025
• yhirose cpp-httplib cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability CVE-2025-53629 Fix available 7.5 HighJuly 10, 2025
• yhirose cpp-httplib cpp-httplib does not limit the length of a line CVE-2025-53628 Fix available 6.3 MediumJuly 10, 2025
• yhirose cpp-httplib cpp-httplib has unlimited number of http header fields, which causes memory leak CVE-2025-52887 Fix available 7.5 HighJune 26, 2025
• cpp-httplib project cpp-httplib cpp-httplib has Unbounded Memory Allocation in Chunked/No-Length Requests CVE-2025-46728 Fix available 7.5 HighMay 6, 2025
• yhirose cpp-httplib CRLF injection in Cpp-httplib CVE-2025-0825 Fix available 6.9 MediumFebruary 4, 2025
• cpp-httplib project cpp-httplib Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when... CVE-2023-26130 Fix available 7.5 HighMay 30, 2023
• yhirose cpp-httplib cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and... CVE-2020-11709 7.5 HighApril 12, 2020