CVE-2020-11709: CRLF Injection
cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the setredirect and setheader functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11709?
CVE-2020-11709 is classified as a medium severity vulnerability due to its potential for CRLF injection and HTTP response splitting.
How do I fix CVE-2020-11709?
To fix CVE-2020-11709, upgrade cpp-httplib to version 0.5.9 or later which includes the necessary input validation.
What versions of cpp-httplib are affected by CVE-2020-11709?
CVE-2020-11709 affects all versions of cpp-httplib up to and including 0.5.8.
What type of attack can CVE-2020-11709 lead to?
CVE-2020-11709 can lead to CRLF injection and HTTP response splitting attacks, compromising web application security.
Are there any workarounds for CVE-2020-11709 if I cannot upgrade?
If an upgrade is not possible, validating and sanitizing user inputs to ensure no \r\n sequences are included can help mitigate CVE-2020-11709.