Detection Guidance

This vulnerability can be detected by monitoring HTTP requests for header values containing percent-encoded CRLF sequences such as %0D%0A, which decode into carriage return and line feed characters allowing header injection.

You can use network inspection tools or command-line utilities like curl or tcpdump to capture and analyze HTTP headers for suspicious encoded sequences.

• Use tcpdump to capture HTTP traffic: tcpdump -A -s 0 'tcp port 80 or tcp port 443'
• Use curl to send test requests with encoded CRLF sequences in headers: curl -H 'X-Custom: a%0D%0AInjected: b' http://target
• Inspect logs or proxy outputs for unexpected header splitting or injection patterns.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade cpp-httplib to version 0.44.0 or later, where the vulnerability is fixed by removing percent-decoding from header parsing or re-validating decoded values to reject control characters.

If upgrading is not immediately possible, consider implementing input validation or filtering to block headers containing percent-encoded CRLF sequences before they reach the vulnerable library.

Additionally, monitor and restrict usage of the vulnerable library as a forward proxy to reduce risk of request smuggling and response splitting.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in cpp-httplib allows CRLF injection attacks through improper percent-decoding of HTTP header values, which can lead to HTTP response splitting, log injection, and request smuggling. Such attacks can result in unauthorized data manipulation, exposure, or tampering.

These security issues can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity, confidentiality, and secure handling of personal and sensitive information. Exploitation of this vulnerability could lead to breaches of these requirements by enabling attackers to manipulate HTTP headers and potentially access or alter protected data.

Therefore, failure to patch this vulnerability may result in non-compliance with these regulations due to increased risk of data breaches and insufficient protection against injection attacks.

Useful 0 Not Useful 0

Executive Summary

The CVE-2026-45372 vulnerability in cpp-httplib involves improper handling of percent-encoded sequences in HTTP header values on the server side. Specifically, the library decodes percent-encoded characters (like %0D%0A representing carriage return and line feed) in all header values except Location and Referer without re-validating the decoded content. This allows encoded CRLF sequences to be expanded into literal control characters inside header values, which violates HTTP standards (RFC 9110 §5.5).

Because the validity check is done before decoding, encoded malicious sequences pass the check and then get decoded, enabling attackers to inject additional HTTP headers or manipulate requests and responses.

This vulnerability enables CRLF injection attacks such as HTTP response splitting, log injection, and request smuggling, especially when the library is used as a forward proxy or when decoded headers are reflected or processed downstream.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts including allowing attackers to perform HTTP response splitting, which can lead to web cache poisoning, cross-site scripting (XSS), and other injection attacks.

It can also enable log injection, corrupting server logs and potentially hiding malicious activity.

Request smuggling attacks are possible, which can bypass security controls, interfere with request routing, or cause unauthorized access.

Additionally, because the decoding affects headers like cookies and X-Forwarded-For, it can cause misinterpretation of requests by the application compared to security devices like WAFs or proxies, increasing the risk of undetected attacks.

Useful 0 Not Useful 0