Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-103930: cpp-httplib library can let attackers alter HTTP request line
CVE-2026-103930 · published 4 days ago
Summary
Versions of the cpp-httplib C++ library from 0.29.0 to 0.51.0 let specially crafted input break the HTTP request line, allowing an attacker to change request details that reach your server. This can happen only if your application passes user‑provided data directly to the library’s open_stream function. Update the library to version 0.51.0 or later to stop the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:22.04:LTS | canonical | cpp-httplib | All versions |
| Debian:12 | debian | cpp-httplib | All versions |
Original advisory text
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
References
- https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2... Third Party Advisory
- https://github.com/yhirose/cpp-httplib/pull/2501 Third Party Advisory
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.51.0 Third Party Advisory
- https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-1039... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-103930 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-103930 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-103930 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-103930 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Timeline
Published14 Oct 2026
Updated17 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-103930 · NVD
CVE-2026-103930 · OSV
GHSA-vq69-f637-8fhr · GHSA
UBUNTU-CVE-2026-103930 · OSV
DEBIAN-CVE-2026-103930 · OSV
Track software like this
Free during beta