Description (CNA)
cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected v0.17.3 through v0.18.3 |
CWE
CWE-113
References
- https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289
- https://advisory.checkmarx.net/advisory/CVE-2025-0825/
ADP enrichment
No English description supplied.
No references supplied.