CVE-2026-21428: cpp-httplib has CRLF injection in http headers
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.30.0, the writeheaders function does not check for CR & LF characters in user supplied headers, allowing untrusted header value to escape header lines. This vulnerability allows attackers to add extra headers, modify request body unexpectedly & trigger an SSRF attack. When combined with a server that supports http1.1 pipelining (springboot, python twisted etc), this can be used for server side request forgery (SSRF). Version 0.30.0 fixes this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21428?
CVE-2026-21428 has a high severity due to potential header injection vulnerabilities in the cpp-httplib library.
How do I fix CVE-2026-21428?
To fix CVE-2026-21428, update cpp-httplib to version 0.30.0 or later.
What are the consequences of exploiting CVE-2026-21428?
Exploiting CVE-2026-21428 could lead to denial of service or the execution of arbitrary commands through HTTP headers.
Which versions of cpp-httplib are affected by CVE-2026-21428?
CVE-2026-21428 affects all versions of cpp-httplib prior to 0.30.0.
What does the write_headers function in cpp-httplib do regarding CVE-2026-21428?
The write_headers function in cpp-httplib fails to validate CR & LF characters in user-supplied headers, which leads to potential header injection vulnerabilities.