CVE-2025-66577
Medium
Description
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can supply X-Forwarded-For or X-Real-IP headers which get accepted unconditionally by get_client_ip() in docker/main.cc, causing access and error logs (nginx_access_logger / nginx_error_logger) to record spoofed client IPs (log poisoning / audit evasion). This vulnerability is fixed in 0.27.0.
SeverityMedium
CVSS5.3
Exploit probability—
ProductYhirose Cpp-httplib
PublishedDec 5, 2025
First seenDec 5, 2025
Weakness typeCWE-117CWE-117CWE-807CWE-807
How to fix
Update
- yhirose cpp-httplib0.27.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yhirose cpp-httplib | v < 0.27.0 | 0.27.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.