Source: cpp-httplib Version: 0.41.0+ds-3 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/yhirose/cpp-httplib/pull/2501
Hi, The following vulnerability was published for cpp-httplib. CVE-2026-103930[0]: | cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 | until 0.51.0, Client::open_stream in httplib.h accepts a caller- | controlled path that reaches detail::write_request_line() without | the detail::encode_path() protection used by the ordinary buffered | request path. Raw carriage-return and line-feed bytes in the path | can therefore split the outbound HTTP/1.1 request line and inject | attacker-shaped request metadata. Exploitation requires an embedding | application to pass remote user input into the open_stream path and | a backend or intermediary that interprets the injected bytes; the | established impact is modification of backend-visible request data, | not direct confidentiality or availability impact. This issue is | fixed in version 0.51.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-103930 https://www.cve.org/CVERecord?id=CVE-2026-103930 [1] https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr [2] https://github.com/yhirose/cpp-httplib/pull/2501 [3] https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a Please adjust the affected versions in the BTS as needed. Regards, Salvatore
