EUVD-2025-201454
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.
Analysis
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public PoC available. Vendor patch is available.
Technical Context
Vulnerability type not specified by vendor. Affects cpp-httplib.
Affected Products
['cpp-httplib']
Remediation
Apply the vendor-supplied patch immediately.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | released | 0.27.0 |
| jammy | released | 0.10.3+ds-1ubuntu0.1~esm1 |
| noble | released | 0.14.3+ds-1.1ubuntu0.1~esm1 |
| plucky | released | 0.18.7-1ubuntu0.25.04.1 |
| questing | released | 0.18.7-1ubuntu0.25.10.1 |
Debian
Bug #1122027| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 0.11.4+ds-1+deb12u1 | - |
| forky, sid, trixie | vulnerable | 0.18.7-1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today