CVE-2025-0825: CRLF injection in Cpp-httplib
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0825?
The severity of CVE-2025-0825 is considered high due to the potential for HTTP Response Splitting and subsequent attacks such as XSS.
How do I fix CVE-2025-0825?
To fix CVE-2025-0825, upgrade cpp-httplib to version v0.18.4 or later, which addresses the CRLF injection vulnerability.
What is CRLF injection in the context of CVE-2025-0825?
CRLF injection in CVE-2025-0825 refers to the ability to manipulate HTTP response headers by injecting CRLF characters due to improper filtering.
What are the potential exploits of CVE-2025-0825?
Potential exploits of CVE-2025-0825 include HTTP Response Splitting and Cross-Site Scripting (XSS), which can compromise application security.
Which versions of cpp-httplib are affected by CVE-2025-0825?
CVE-2025-0825 affects cpp-httplib versions v0.17.3 through v0.18.3.