CVE-2025-0825

Medium

Description

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

SeverityMedium

CVSS5.3

Exploit probability—

ProductYhirose Cpp-httplib

PublishedFeb 4, 2025

First seenFeb 4, 2025

Weakness typeCWE-113CWE-113

How to fix

Update

yhirose cpp-httplib0.18.4 or later

Patches

github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289

Affected products

Product	Affected versions	Fixed in
yhirose cpp-httplib	0.17.3 ≤ v < 0.18.4	0.18.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.