Which versions of Cpp Httplib are affected by CVE-2025-0825?

CVE-2025-0825 presents notable security risk rated CVSS 6.9. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2025-0825?

Yes, a public proof-of-concept exploit is available for CVE-2025-0825. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-0825?

Within 7 days: Identify affected systems and apply vendor patches promptly. Vendor patch is available.

Cpp Httplib CVE-2025-0825

Q: What is the CVSS score of CVE-2025-0825?

CVE-2025-0825 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

HTTP Response Splitting (CWE-113)

2025-02-04 596c5446-0ce5-4ba2-aa66-48b3b757a647

XSS Cpp Httplib Suse Yhirose

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:24 vuln.today

Patch released

Mar 28, 2026 - 18:24 nvd

Patch available

PoC Detected

Aug 04, 2025 - 15:06 vuln.today

Public exploit code

CVE Published

Feb 04, 2025 - 15:15 nvd

MEDIUM 6.9

DescriptionCVE.org

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

AnalysisAI

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-113. cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more. Affected products include: Yhirose Cpp-Httplib.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cpp Httplib

View all

CVE-2025-66570 CRITICAL Act Now POC

10.0 Dec 05

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow

CVE-2025-53628 HIGH This Week POC

8.8 Jul 10

CVE-2025-53628 is a memory exhaustion vulnerability in cpp-httplib versions prior to 0.20.1 that allows unauthenticated

CVE-2025-46728 HIGH This Week POC

7.5 May 06

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Rated high severity (CVSS 7.5), this vulnerabilit

CVE-2025-52887 HIGH This Week POC

7.5 Jun 26

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http head

CVE-2025-53629 HIGH This Week POC

7.5 Jul 10

CVE-2025-53629 is a Denial of Service vulnerability in cpp-httplib versions prior to 0.23.0 that allows unauthenticated

CVE-2026-22776 HIGH This Week POC

7.5 Jan 12

cpp-httplib versions prior to 0.30.1 are vulnerable to denial of service attacks due to insufficient validation of decom

CVE-2026-28435 HIGH This Week POC

7.5 Mar 04

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 7.5 HIGH]

CVE-2026-21428 HIGH This Week POC

7.5 Jan 01

Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request bo

CVE-2020-11709 HIGH This Week POC

7.5 Apr 12

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, whic

CVE-2026-45372 CRITICAL Act Now

9.9 May 29

HTTP response/header injection in cpp-httplib server versions prior to 0.44.0 allows remote unauthenticated attackers to

CVE-2026-29076 MEDIUM This Month POC

5.9 Mar 07

Remote denial of service in cpp-httplib prior to version 0.37.0 allows unauthenticated attackers to crash server process

CVE-2025-66577 MEDIUM This Month POC

5.3 Dec 05

A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public Po

Same weakness CWE-113 – HTTP Response Splitting

View all

CVE-2024-52875 HIGH POC

8.8

CVE-2016-5699 MEDIUM POC

6.1

CVE-2016-8024 HIGH POC

8.1

CVE-2026-75419 HIGH POC

8.8

CVE-2018-11347 HIGH POC

8.8

CVE-2018-3911 HIGH POC

8.6

CVE-2018-7830 HIGH POC

7.5

CVE-2022-41915 MEDIUM POC

6.5

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-1710 CRITICAL POC

10.0

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2024-52875 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2025-0825 vulnerability details – vuln.today

Back

Cpp Httplib CVE-2025-0825

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Cpp Httplib

Same weakness CWE-113 – HTTP Response Splitting

Same technique XSS

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code