Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103930— cpp-httplib open_stream serializes CRLF in request target into HTTP request line

Quick assessment

Affected
yhirose cpp-httplib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

cpp-httplib 是一个仅头文件的 C++ HTTP/HTTPS 库。从版本 0.29.0 到 0.51.0（含），httplib.h 中的 函数接受由调用方控制的路径参数，该路径会直接传递到 函数，而未使用普通缓冲请求路径中所采用的 编码保护机制。因此，路径中包含的原始回车（CR）和换行（LF）字符可能导致出站 HTTP/1.1 请求行被截断，并注入攻击者构造的请求元数据。 利用该漏洞需要嵌入应用程序将远程用户输入传入 的路径参数，并且后端或中间节点会解析这些被注入的字节。该漏洞的影响主要是修改后端可见的请

CVSS 3.7 · Low EPSS 0.37% · P29

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
yhirose cpp-httplib >= 0.29.0, < 0.51.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103930

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
Source: CVE Program / CVE List V5
Vulnerability Description
cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP头部中CRLF序列转义处理不恰当(HTTP响应分割)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
yhirose cpp-httplib >= 0.29.0, < 0.51.0 -

II. Public POCs for CVE-2026-103930

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103930

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103930 (1)

Other References for CVE-2026-103930 (2)

IV. Related Vulnerabilities

Same product: cpp-httplib
Same vendor: yhirose
Same weakness: CWE-113

V. Comments for CVE-2026-103930

No comments yet

Leave a comment