What is the CVSS score of EUVD-2026-33427?

EUVD-2026-33427 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Suse are affected by EUVD-2026-33427?

cpp-httplib server versions prior to 0.44.0 contain a critical HTTP header injection vulnerability (CVSS 9.9) that allows remote unauthenticated attackers to manipulate response headers, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-33427?

Within 24 hours: Conduct inventory of all systems running cpp-httplib and identify version numbers to assess exposure scope. Within 7 days: Deploy network-level access controls to restrict traffic to cpp-httplib instances and implement WAF rules to block CRLF injection patterns (%0D%0A, encoded variants). Within 30 days: Monitor cpp-httplib project releases for version 0.44.0 or later and plan deployment of patched versions across affected infrastructure.

Suse EUVD-2026-33427

| CVE-2026-45372 CRITICAL

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-05-29 GitHub_M

Information Disclosure Suse

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Analysis Generated

May 29, 2026 - 20:30 vuln.today

DescriptionGitHub Advisory

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

AnalysisAI

HTTP response/header injection in cpp-httplib server versions prior to 0.44.0 allows remote unauthenticated attackers to smuggle CRLF sequences into stored header values, because the is_field_value validity check runs before percent-decoding lets %0D%0A through and expand to literal \r\n. The CVSS 9.9 score with Scope:Changed reflects the ability to influence downstream HTTP components, but no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Conduct inventory of all systems running cpp-httplib and identify version numbers to assess exposure scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all

CVE-2026-23953 HIGH POC

8.7

CVE-2026-21428 HIGH POC

7.5

CVE-2025-25184 MEDIUM POC

5.7

CVE-2026-1536 MEDIUM POC

5.8

CVE-2026-1467 MEDIUM POC

5.8

CVE-2026-11362 CRITICAL

9.8

CVE-2026-30227 MEDIUM POC

5.3

CVE-2026-34458 CRITICAL

9.3

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 16.0	Fixed

EUVD-2026-33427 vulnerability details – vuln.today

Back

Suse EUVD-2026-33427

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Recommended ActionAI

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code