Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yhirose | cpp-httplib | < 0.44.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cpp-httplib | No fix yet | — |
| Debian 13 | cpp-httplib | No fix yet | — |
| Debian 12 | cpp-httplib | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cpp-httplib | No fix yet | — |
| Ubuntu 25.10 | cpp-httplib | 0.18.7-1ubuntu0.25.10.2 | USN-8470-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | cpp-httplib | 0.26.0+ds-2ubuntu3+esm1 | USN-8470-1 |
| Ubuntu Pro 24.04 LTS | cpp-httplib | 0.14.3+ds-1.1ubuntu0.1~esm2 | USN-8470-1 |
| Ubuntu Pro 22.04 LTS | cpp-httplib | 0.10.3+ds-1ubuntu0.1~esm2 | USN-8470-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cpp-httplib | 0.46.1-1.1 | openSUSE-SU-2026:10994-1 |
Advisories 2
- USN-8470-1 cpp-httplib vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2026:10994-1 cpp-httplib-devel-0.46.1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 12, 2026