CVE-2026-103930

Deferred Deferred - Pending Action

HTTP Request Line Injection in cpp-httplib

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103930

EUVD

EUVD-2026-101593

Affected Vendors & Products

Vendor	Product	Version / Range
yhirose	cpp-httplib	>= 0.29.0, < 0.51.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-113	The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

Executive Summary

This vulnerability affects the cpp-httplib library versions 0.29.0 to 0.51.0. It allows raw carriage-return (CR) and line-feed (LF) bytes in HTTP request paths to split the request line and inject malicious request metadata. The streaming client API (Client::open_stream) does not encode these characters, bypassing protections in the buffered path. Exploitation requires user input passed to this API and a backend interpreting the injected bytes.

Detection Guidance

To detect this vulnerability, inspect applications using cpp-httplib versions 0.29.0 to 0.50.1 for improper handling of CR/LF characters in HTTP request paths. Check if Client::open_stream is called with user-controlled input without path encoding. Use static analysis tools to identify unencoded path handling in streaming client APIs.

Impact Analysis

If exploited, this vulnerability could allow attackers to modify backend-visible request data by injecting headers or additional requests. This could lead to unauthorized actions, data leaks, or misdirection of requests. The impact depends on how the application processes user input and the backend's interpretation of malformed requests.

Compliance Impact

This vulnerability primarily impacts request integrity, which could lead to unauthorized data access or modification. For GDPR, it may affect data integrity and security measures. For HIPAA, it could compromise protected health information integrity. Compliance impact depends on the specific deployment and data processed.

Mitigation Strategies

Upgrade cpp-httplib to version 0.51.0 or later. If upgrading is not possible, modify ClientImpl::open_stream to encode the path using detail::encode_path before constructing the request line. Ensure all user-controlled input passed to Client::open_stream is properly sanitized and encoded.

Hi! I’m here to help you understand CVE-2026-103930. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70