CVE-2023-26130

🗓️ 30 May 2023 05:00:02Reported by snykType

cve🔗 web.nvd.nist.gov👁 85 Views🌐 WEB

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests

Reporter	Title	Published	Views	Family All 33
BDU FSTEC	cpp-httplib CRLF Injection	20 Jun 202300:00	–	bdu_fstec
CNNVD	cpp-httplib injection vulnerability	30 May 202300:00	–	cnnvd
Cvelist	CVE-2023-26130	30 May 202305:00	–	cvelist
Debian CVE	CVE-2023-26130	30 May 202305:00	–	debiancve
EUVD	EUVD-2023-29977	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 38 Update: cpp-httplib-0.12.5-1.fc38	11 Jun 202302:03	–	fedora
Fedora	[SECURITY] Fedora 38 Update: et-6.2.8-1.fc38	2 May 202401:45	–	fedora
Fedora	[SECURITY] Fedora 40 Update: et-6.2.8-1.fc40	2 May 202401:58	–	fedora
Fedora	[SECURITY] Fedora 39 Update: et-6.2.8-1.fc39	2 May 202401:39	–	fedora
Tenable Nessus	Fedora 38 : cpp-httplib (2023-0070b20b20)	12 Jun 202300:00	–	nessus

NVD

Vulners

Vulnrichment

Node

cpp-httplib_project cpp-httplibRange<0.12.4

[
  {
    "product": "yhirose/cpp-httplib",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.12.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/
github	www.github.com/yhirose/cpp-httplib/releases/tag/v0.12.4
gist	www.gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L/
github	www.github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08
security	www.security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL/

Parameter	Position	Path	Description	CWE
Content-Type	header	/	CRLF injection in the Content-Type header during .Patch, .Post, .Put, and .Delete requests due to incomplete fix in cpp-httplib.	CWE-74, CWE-77, CWE-93

17 Jun 2026 05:42Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5 - 8.8

EPSS0.01137

SSVC

cve-2023-26130 package yhirose/cpp-httplib crlf injection http security vulnerability cve-2020-11709