CVE-2026-45372: cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (isfieldvalue) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cpp-httplibto a version that resolves this vulnerability.Fixed in 0.44.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45372?
The severity of CVE-2026-45372 is critical with a score of 9.9.
What is the main issue described in CVE-2026-45372?
CVE-2026-45372 describes a CRLF injection vulnerability caused by improper handling of percent-decoding in HTTP header values.
How do I fix CVE-2026-45372?
To fix CVE-2026-45372, update cpp-httplib to version 0.44.0 or later where the vulnerability has been patched.
What impact does CVE-2026-45372 have on applications using cpp-httplib?
CVE-2026-45372 can allow attackers to perform CRLF injection, potentially leading to HTTP response splitting and header manipulation.
Which versions of cpp-httplib are affected by CVE-2026-45372?
CVE-2026-45372 affects versions prior to 0.44.0 of cpp-httplib.