CVE-2026-45372: Cpp-httplib Header Injection Vulnerability

CVE-2026-45372 Overview

CVE-2026-45372 is a CRLF injection vulnerability in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library maintained by yhirose. The flaw exists in versions prior to 0.44.0. When the server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check is_field_value runs before decoding, so encoded %0D%0A sequences pass validation and expand into literal \r\n bytes inside the stored header value. This enables HTTP response splitting and header injection attacks [CWE-93].

Critical Impact
Remote attackers can inject arbitrary HTTP headers and split responses without authentication, enabling cache poisoning, session fixation, and cross-site scripting against downstream clients.

Affected Products

yhirose cpp-httplib versions prior to 0.44.0
Applications and services embedding the vulnerable httplib.h header
HTTP and HTTPS server implementations built on cpp-httplib

Discovery Timeline

2026-05-29 - CVE-2026-45372 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45372

Vulnerability Analysis

The vulnerability stems from an ordering flaw in how cpp-httplib processes inbound HTTP header values. The library validates the raw header value first using is_field_value, which correctly rejects literal carriage return and line feed characters. After validation passes, the library then percent-decodes the value before storing it in the request structure.

This decode-after-validate sequence allows an attacker to smuggle %0D%0A through the parser. The encoded bytes survive validation because they are valid printable ASCII characters. Once decoded, they become a literal \r\n pair inside the stored header. Any downstream code that echoes the value into a response or forwards it to another service will emit attacker-controlled header boundaries.

Root Cause

The root cause is improper neutralization of CRLF sequences in HTTP headers, classified as [CWE-93]. Validation must be applied to the final canonical form of the input, not the wire form. By percent-decoding after the validity check, cpp-httplib creates a parser differential between what it inspects and what it stores.

Attack Vector

An unauthenticated remote attacker sends an HTTP request containing a header value with embedded %0D%0A sequences. The server accepts the request, decodes the value, and writes the resulting \r\n bytes into application state. When the application reflects the header into a response, sets a cookie based on it, or forwards it to a proxy, the injected newlines split the HTTP stream. Consequences include HTTP response splitting, web cache poisoning, session fixation, and reflected cross-site scripting through manipulated response headers.

No verified public exploit code is currently available. See the GitHub Security Advisory GHSA-xjxg-64p4-vj4m for vendor details.

Detection Methods for CVE-2026-45372

Indicators of Compromise

Inbound HTTP requests containing %0D%0A, %0d%0a, or mixed-case variants within header values other than Location and Referer
Server logs showing unexpected header continuations or duplicate Set-Cookie, Content-Type, or Content-Length headers in responses
Web cache entries with anomalous header boundaries or response bodies that do not match the requested resource

Detection Strategies

Inspect raw HTTP request bytes at the network or proxy layer for percent-encoded CRLF sequences in header values
Compare the version of httplib.h embedded in deployed binaries against 0.44.0 using software composition analysis
Add web application firewall rules that block %0D, %0A, %0d, and %0a in non-allowlisted header fields

Monitoring Recommendations

Enable verbose access logging on cpp-httplib services and forward logs to a centralized SIEM for pattern matching on encoded CRLF
Alert on HTTP responses that contain more \r\n\r\n separators than expected, which indicates response splitting
Track outbound proxy traffic for header values originating from cpp-httplib hosts that contain control characters

How to Mitigate CVE-2026-45372

Immediate Actions Required

Upgrade cpp-httplib to version 0.44.0 or later and rebuild all dependent binaries
Inventory every internal and third-party application that statically links httplib.h and prioritize internet-facing services
Deploy WAF or reverse proxy rules that reject requests containing percent-encoded CRLF in header values until patching completes

Patch Information

The maintainer fixed the issue in cpp-httplib 0.44.0 by adjusting the parser so percent-decoded header values are revalidated, preventing smuggled CRLF bytes from reaching the stored request state. Refer to the GitHub Security Advisory GHSA-xjxg-64p4-vj4m for the official fix commit and release notes.

Workarounds

Place cpp-httplib services behind a hardened reverse proxy such as nginx or HAProxy that normalizes and validates header values before forwarding
Strip or reject any inbound header value containing %0D, %0A, or their lowercase equivalents at the edge
Sanitize all header values read from the request object before reflecting them into responses, setting cookies, or forwarding them upstream

bash

# Example nginx rule to block encoded CRLF in header values
if ($http_user_agent ~* "%0[da]") { return 400; }
if ($http_x_forwarded_for ~* "%0[da]") { return 400; }
# Verify cpp-httplib version embedded in a binary
strings ./your_service | grep -i "cpp-httplib"