What is the CVSS score of CVE-2026-45372?

CVE-2026-45372 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Cpp Httplib are affected by CVE-2026-45372?

cpp-httplib server versions prior to 0.44.0 contain a critical HTTP header injection vulnerability (CVSS 9.9) that allows remote unauthenticated attackers to manipulate response headers, potentially…. A patch is available.

How to fix or mitigate CVE-2026-45372?

Within 24 hours: Conduct inventory of all systems running cpp-httplib and identify version numbers to assess exposure scope. Within 7 days: Deploy network-level access controls to restrict traffic to cpp-httplib instances and implement WAF rules to block CRLF injection patterns (%0D%0A, encoded variants). Within 30 days: Monitor cpp-httplib project releases for version 0.44.0 or later and plan deployment of patched versions across affected infrastructure.

Cpp Httplib CVE-2026-45372

EUVD-2026-33427 CRITICAL

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-05-29 GitHub_M

Information Disclosure Cpp Httplib Yhirose

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

SUSE

CRITICAL

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Analysis Generated

May 29, 2026 - 20:30 vuln.today

DescriptionCVE.org

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

AnalysisAI

HTTP response/header injection in cpp-httplib server versions prior to 0.44.0 allows remote unauthenticated attackers to smuggle CRLF sequences into stored header values, because the is_field_value validity check runs before percent-decoding lets %0D%0A through and expand to literal \r\n. The CVSS 9.9 score with Scope:Changed reflects the ability to influence downstream HTTP components, but no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

More in Cpp Httplib

View all

CVE-2025-66570 CRITICAL Act Now POC

10.0 Dec 05

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow

CVE-2025-53628 HIGH This Week POC

8.8 Jul 10

CVE-2025-53628 is a memory exhaustion vulnerability in cpp-httplib versions prior to 0.20.1 that allows unauthenticated

CVE-2025-46728 HIGH This Week POC

7.5 May 06

cpp-httplib is a C++ header-only HTTP/HTTPS server and client library. Rated high severity (CVSS 7.5), this vulnerabilit

CVE-2025-52887 HIGH This Week POC

7.5 Jun 26

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http head

CVE-2025-53629 HIGH This Week POC

7.5 Jul 10

CVE-2025-53629 is a Denial of Service vulnerability in cpp-httplib versions prior to 0.23.0 that allows unauthenticated

CVE-2026-22776 HIGH This Week POC

7.5 Jan 12

cpp-httplib versions prior to 0.30.1 are vulnerable to denial of service attacks due to insufficient validation of decom

CVE-2026-28435 HIGH This Week POC

7.5 Mar 04

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 7.5 HIGH]

CVE-2026-21428 HIGH This Week POC

7.5 Jan 01

Cpp-Httplib versions up to 0.30.0 contains a vulnerability that allows attackers to add extra headers, modify request bo

CVE-2020-11709 HIGH This Week POC

7.5 Apr 12

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the set_redirect and set_header functions, whic

CVE-2026-29076 MEDIUM This Month POC

5.9 Mar 07

Remote denial of service in cpp-httplib prior to version 0.37.0 allows unauthenticated attackers to crash server process

CVE-2025-66577 MEDIUM This Month POC

5.3 Dec 05

A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public Po

CVE-2026-28434 MEDIUM This Month POC

5.3 Mar 04

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. [CVSS 5.3 MEDIUM]

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all

CVE-2016-3115 MEDIUM POC

6.4

CVE-2021-39172 HIGH POC

8.8

CVE-2026-23953 HIGH POC

8.7

CVE-2026-54511 HIGH POC

8.6

CVE-2026-70615 HIGH POC

8.5

CVE-2024-45302 HIGH POC

7.8

CVE-2017-5868 MEDIUM POC

6.1

CVE-2026-75925 CRITICAL

9.4

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 16.0	Fixed

CVE-2026-45372 vulnerability details – vuln.today

Back

Cpp Httplib CVE-2026-45372

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

More in Cpp Httplib

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code