CVE-2025-66577: cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by getclientip() in docker/main.cc, causing access and error logs (nginxaccesslogger / nginxerrorlogger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66577?
CVE-2025-66577 has a severity rating that indicates a significant risk due to attacker-controlled HTTP headers affecting metadata and authorization decisions.
How do I fix CVE-2025-66577?
To fix CVE-2025-66577, upgrade cpp-httplib to version 0.27.0 or later where the vulnerability has been addressed.
What versions of cpp-httplib are affected by CVE-2025-66577?
CVE-2025-66577 affects all versions of cpp-httplib prior to 0.27.0.
What potential impact does CVE-2025-66577 have on my application?
The impact of CVE-2025-66577 includes unauthorized access to logs, manipulation of server metadata, and potential bypass of authorization controls.
Is there a known exploit for CVE-2025-66577?
Currently, there are no publicly disclosed exploits specifically targeting CVE-2025-66577.