CVE-2023-26130: CRLF Injection
Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This issue is present due to an incomplete fix for CVE-2020-11709.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-26130?
CVE-2023-26130 has a moderate severity level due to the potential for logical errors and misbehavior resulting from CRLF Injection.
How do I fix CVE-2023-26130?
To fix CVE-2023-26130, upgrade the cpp-httplib package to version 0.12.4 or later.
What causes the vulnerability in CVE-2023-26130?
CVE-2023-26130 is caused by the improper handling of untrusted user input resulting in CRLF Injection in HTTP requests.
Which versions of cpp-httplib are affected by CVE-2023-26130?
CVE-2023-26130 affects versions of cpp-httplib prior to 0.12.4.
What are the potential impacts of CVE-2023-26130?
The potential impacts of CVE-2023-26130 include logical errors and unpredictable application behavior due to CRLF Injection.