What is the CVSS score of CVE-2025-66570?

CVE-2025-66570 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2025-66570?

A critical vulnerability in cpp-httplib (CVE-2025-66570) allows attackers to forge HTTP headers that spoof client IP addresses and network metadata, potentially bypassing authentication,…. A patch is available.

Is there a public PoC exploit available for CVE-2025-66570?

Yes, a public proof-of-concept exploit is available for CVE-2025-66570. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-66570?

Within 24 hours: Identify all internal and external applications using cpp-httplib and document their version numbers and exposure level. Within 7 days: Upgrade cpp-httplib to version 0.27.0 or later across all systems, prioritizing internet-facing and authentication-critical applications. Within 30 days: Conduct security audit of access logs and authorization decisions from the past 90 days to detect potential exploitation, and implement header validation rules at network ingress points.

Docker CVE-2025-66570

EUVD-2025-201455 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2025-12-05 security-advisories@github.com

Authentication Bypass Docker Ubuntu Debian Cpp Httplib Suse

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Ubuntu

HIGH

qualitative

SUSE

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201455

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

Patch released

Mar 15, 2026 - 17:08 nvd

Patch available

PoC Detected

Dec 10, 2025 - 15:02 vuln.today

Public exploit code

CVE Published

Dec 05, 2025 - 19:15 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.

Analysis

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Authentication Bypass by Spoofing (CWE-290).

RemediationAI

A vendor patch is available — apply it immediately. Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.

More in Docker

View all

CVE-2024-55964 CRITICAL Emergency POC

9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl

CVE-2019-5736 HIGH Act Now POC

8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac

CVE-2023-32077 HIGH Act Now POC

7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2023-5815 HIGH Act Now POC

8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post

CVE-2014-9357 CRITICAL Act Now

10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build

CVE-2026-34156 CRITICAL Act Now POC

9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l

CVE-2019-15752 HIGH Act Now POC

7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

CVE-2025-34221 CRITICAL Act Now POC

10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2

CVE-2024-23054 CRITICAL Act Now POC

9.8 Feb 05

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du

CVE-2025-23211 CRITICAL Act Now POC

9.9 Jan 28

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve

CVE-2026-46339 CRITICAL Act Now POC

10.0 May 19

Unauthenticated remote code execution in 9router (npm package) versions 0.4.30 through 0.4.36 allows network-adjacent at

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all

CVE-2024-54085 CRITICAL

9.8

CVE-2023-50224 MEDIUM

6.5

CVE-2024-4358 CRITICAL POC

9.8

CVE-2018-5353 CRITICAL POC

9.8

CVE-2023-51350 CRITICAL POC

9.8

CVE-2022-3180 CRITICAL

9.8

CVE-2025-49002 CRITICAL POC

9.8

CVE-2020-37056 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: High

cpp-httplib

Release	Status	Version
jammy	released	0.10.3+ds-1ubuntu0.1~esm1
noble	released	0.14.3+ds-1.1ubuntu0.1~esm1
plucky	released	0.18.7-1ubuntu0.25.04.1
questing	released	0.18.7-1ubuntu0.25.10.1
upstream	released	0.27.0

USN-7962-1

Debian

Bug #1122027

cpp-httplib

Release	Status	Fixed Version	Urgency
bookworm	vulnerable	0.11.4+ds-1+deb12u1	-
forky, sid, trixie	vulnerable	0.18.7-1	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.0	Fixed

CVE-2025-66570 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

Docker CVE-2025-66570

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

More in Docker

Same weakness CWE-290 – Authentication Bypass by Spoofing

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code