CVE-2026-45372
A critical flaw in the cpp-httplib library allows attackers to inject carriage return and line feed characters into HTTP headers. The bug occurs because percent-decoded values are stored without validation. Updating to version 0.44.0 or later removes the vulnerability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
The C++ header‑only library cpp‑httplib (yhirose) versions earlier than 0.44.0, used by developers building cross‑platform HTTP servers.
Real-world impact
An attacker could insert malicious header values that may lead to header injection attacks, potentially causing unintended redirects, cross‑site scripting, or other HTTP header manipulation.
Why this severity
The CVSS score is high because the flaw is exploitable over the network, requires no user interaction, and can compromise confidentiality and integrity of data.
What to do about it
- 01Upgrade cpp-httplib to version 0.44.0 or later.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/yhirose/cpp-httplib/securit…exploitmitigationvendor advisory