HTTP/HTTPS Library Vulnerability in C++ Library from Vendor cpp-httplib
CVE-2026-103930

3.7LOW

Key Information:

Vendor

Yhirose

Status
Cpp-httplib
Vendor
CVE Published:
14 October 2026

What is CVE-2026-103930?

The cpp-httplib library, a header-only C++ HTTP/HTTPS solution, has a vulnerability that arises from its handling of user-controlled paths in the Client::open_stream function. This allows raw carriage return and line feed characters to be included in the outbound HTTP/1.1 request line, potentially enabling an attacker to inject crafted request metadata. The issue occurs when an application passes untrusted user input into this function, thus allowing an intermediary server to interpret the injected characters. While there are no direct impacts on confidentiality or availability, it can lead to potentially harmful modifications of the request data visible to the backend. The vulnerability has been addressed in version 0.51.0.

Affected Version(s)

cpp-httplib >= 0.29.0, < 0.51.0

References

https://github.com/yhirose/cpp-httplib/security/advisorie...
x_refsource_CONFIRM
https://github.com/yhirose/cpp-httplib/pull/2501
x_refsource_MISC
https://github.com/yhirose/cpp-httplib/commit/255c075b82c...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.