CVE-2026-103930: cpp-httplib open_stream serializes CRLF in request target into HTTP request line
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline() without the detail::encodepath() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the openstream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpp-httplibto a version that resolves this vulnerability.Fixed in 0.51.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using cpp-httplib versions from 0.29.0 through before 0.51.0 are exposed only if they pass remote user-controlled input as the path argument to Client::open_stream. The injected request data must also be accepted or interpreted by the destination backend or an intermediary.
Is normal buffered request handling affected?
The described issue is specific to Client::open_stream. The ordinary buffered request path uses detail::encode_path(), which is the protection missing from the affected streaming path.
What does an attacker need to exploit it?
An attacker needs influence over the path supplied by the embedding application to Client::open_stream and must be able to include raw carriage-return and line-feed bytes. Successful exploitation also depends on a backend or intermediary interpreting those bytes as injected HTTP request metadata.
What can be done before upgrading?
Do not pass untrusted input directly to Client::open_stream as its path. Ensure carriage-return and line-feed bytes are rejected or safely encoded before constructing the request path.
How can I determine whether my application is affected?
Review uses of Client::open_stream and trace the path argument back to its source. The application is at risk if remote input can reach that argument without filtering or encoding CR and LF characters, and it uses an affected cpp-httplib version.