HTTP Header Injection Vulnerability in cpp-httplib by Yhirose

CVE-2025-66570

What is CVE-2025-66570?

The cpp-httplib library, a header-only C++11 HTTP/HTTPS framework, is susceptible to a vulnerability that allows attackers to manipulate server-visible metadata and logging through injected HTTP headers. Prior to version 0.27.0, malicious actors can exploit the library by sending crafted HTTP headers such as REMOTE_ADDR and LOCAL_PORT. These headers are parsed into the server's request header multimap, which can lead to authorization bypass and log poisoning due to the way server-inserted headers are combined with client-supplied headers. This vulnerability poses serious risks, including the ability to spoof IP addresses and manipulate logging data, potentially affecting the security posture of applications that rely on the cpp-httplib library. Users are advised to upgrade to version 0.27.0 or later to mitigate these risks.

References