AIKIDO-2026-369961
yhirose.cpp-httplib is vulnerable to CRLF Injection
61
Medium Risk
This Affects:
yhirose.cpp-httplibTL;DR
The library writes HTTP trailer field names and values in write_content_chunked through the DataSink::done_with_trailer path without validating them, unlike other header output paths. When an application reflects untrusted input into chunked-response trailers, carriage-return and line-feed characters pass through unfiltered. This allows HTTP response splitting and can enable cache poisoning, cross-site scripting, or session fixation against clients. The fix validates trailer field names and values and silently skips entries that are not well-formed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application reflects untrusted input into chunked-response trailer fields.
Background info
yhirose.cpp-httplib is vulnerable to CRLF Injection in versions 0.12.2 - 0.49.0.
How to fix this
Upgrade the yhirose.cpp-httplib library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.