CVE-2023-26130CWE-93

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in…

High · published May 30, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01137 · 66.3th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2023-05-30T05:00Z
EPSS history
Timeline
  • 30 MAY 05:00Z
    Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in…
    cvelistv5