Skip to content
OpenAdvisories
Critical USN-8470-1 1 CVE

cpp-httplib vulnerability

Published Jun 25, 2026 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that cpp-httplib incorrectly percent-decoded HTTP
request header values. A remote attacker could use this to inject crafted
header content possibly leading to response splitting, log injection
or proxy smuggling.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 25.10 cpp-httplib 0.18.7-1ubuntu0.25.10.2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS cpp-httplib 0.10.3+ds-1ubuntu0.1~esm2
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS cpp-httplib 0.14.3+ds-1.1ubuntu0.1~esm2
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS cpp-httplib 0.26.0+ds-2ubuntu3+esm1

Vulnerabilities 1

  • Critical 9.9
    CVE-2026-45372

    cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_fiel…

    yhirose cpp-httplib cpp-httplib cpp-httplib Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2026-45372