CVE-2026-45372 - Exploits & Severity

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

NVD published the first details for CVE-2026-45372

A CVSS base score of 9.9 has been assigned.

Feedly found the first article mentioning CVE-2026-45372 . See article

CVE-2026-45372 is a critical header parsing vulnerability in cpp-httplib, with a CVSS score of 9.9, allowing attackers to inject carriage return and newline byte pairs into HTTP header values due to improper handling of percent-encoded input. Exploitation requires network access to a vulnerable server, and while no public proof-of-concept exploits are available, the flaw can lead to serious HTTP-level attacks such as response splitting and request smuggling. The vulnerability is mitigated in cpp-httplib version 0.44.0, and users are advised to upgrade to this version or newer. See article

cpp-httplib Critical Header Parsing Vulnerability (CVE-2026-45372)

CVE-2026-45372 - Exploits & Severity - Feedly

CVE-2026-45372 | yhirose cpp-httplib up to 0.43.x is_field_value crlf injection (GHSA-xjxg-64p4-vj4m)

CVE-2026-45372: cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection [CRITICAL] CVSS 9.9

cpp-httplib Critical Header Parsing Vulnerability (CVE-2026-45372)

Collect, analyze, and vulnerability reports faster using AI