cpp-httplib CVE-2026-103930

Two conditions must both hold: (1) the embedding application must pass remote attacker-controlled input as the request path into Client::open_stream - or into the client path with set_path_encode(false), such as a decoded redirect Location - so that detail::write_request_line() is reached without detail::encode_path() sanitization; and (2) a backend server or intermediary proxy must interpret the injected raw CR/LF bytes as request-line/header boundaries. Limiting factors that reduce realistic risk: this requires a non-default usage pattern in the host application (default buffered request path is not affected), impact is limited to integrity of request data (no confidentiality or availability loss), and only versions 0.29.0 through 0.50.x are affected (fixed in 0.51.0). No authentication is required by the library itself (PR:N), but the application-side misuse requirement makes opportunistic exploitation impractical (AC:H).

This is a low-priority, defense-in-depth fix rather than an urgent threat. The NVD CVSS 3.1 score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is driven down by high attack complexity (AC:H) and a limited, integrity-only impact (I:L; C:N/A:N) - consistent with the advisory's statement that the established impact is modification of backend-visible request data, not direct confidentiality or availability loss. No EPSS score was supplied in the input, and the CVE is not listed in CISA KEV; no public exploit code was referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent: a genuinely networked vector (AV:N, PR:N on the library itself) but gated by AC:H because real-world exploitation depends on an embedding application misusing open_stream and on a downstream parser honoring the injected CR/LF. The one nuance to verify: PR:N reflects that cpp-httplib imposes no authentication, but exploitation requires a non-default coding pattern in the host application (passing raw remote input into open_stream, typically with path encoding disabled) - this application-side precondition, not any library credential, is the real limiter and is already captured by AC:H.

An application embeds cpp-httplib (0.29.0-0.50.x) and passes attacker-controlled input - for example a decoded redirect Location under set_path_encode(false) - as the request path into Client::open_stream, which skips encode_path(). The attacker supplies a value containing CR/LF (e.g. a %0D%0A sequence that decodes to raw carriage-return/line-feed), splitting the outbound HTTP/1.1 request line and injecting attacker-shaped headers or an entire second request that a backend or intermediary then interprets. No public proof-of-concept was referenced, and the high attack complexity reflects the required application misuse and a cooperating downstream parser.