CVE-2026-103930 Details
Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
A vulnerability in cpp-httplib versions 0.29.0 prior to 0.51.0 allows for injection of custom request metadata into the HTTP request line. This issue arises because the Client::open_stream function accepts a caller-controlled path that bypasses the usual path encoding protections. As a result, raw carriage return and line feed characters can split the request line and inject headers or other metadata. Exploitation requires an application to pass remote user input into the open_stream path, and a backend or intermediary that interprets the injected bytes. The impact is a modification of request data visible to the backend, without directly affecting confidentiality or availability.
Users can upgrade to cpp-httplib version 0.51.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a | [email protected] | Source CodeVendor |
| https://github.com/yhirose/cpp-httplib/pull/2501 | [email protected] | Source CodeVendor |
| https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0 | [email protected] | Release NotesVendor |
| https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yhirose-cpp-httplib | >= 0.29.0, <= 0.50.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |