CVE-2023-26130

🗓️ 30 May 2023 05:00:02Reported by snykType

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests

Reporter	Title	Published	Views	Family All 30
CNNVD	cpp-httplib 注入漏洞	30 May 202300:00	–	cnnvd
Cvelist	CVE-2023-26130	30 May 202305:00	–	cvelist
Debian CVE	CVE-2023-26130	30 May 202305:00	–	debiancve
EUVD	EUVD-2023-29977	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 38 Update: cpp-httplib-0.12.5-1.fc38	11 Jun 202302:03	–	fedora
Fedora	[SECURITY] Fedora 38 Update: et-6.2.8-1.fc38	2 May 202401:45	–	fedora
Fedora	[SECURITY] Fedora 40 Update: et-6.2.8-1.fc40	2 May 202401:58	–	fedora
Fedora	[SECURITY] Fedora 39 Update: et-6.2.8-1.fc39	2 May 202401:39	–	fedora
Tenable Nessus	Fedora 38 : cpp-httplib (2023-0070b20b20)	12 Jun 202300:00	–	nessus
Tenable Nessus	Fedora 39 : et (2024-94a155818c)	1 May 202400:00	–	nessus

NVD

Node

cpp-httplib_project cpp-httplibRange<0.12.4

[
  {
    "product": "yhirose/cpp-httplib",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.12.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP/
github	www.github.com/yhirose/cpp-httplib/releases/tag/v0.12.4
security	www.security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL/
gist	www.gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280
github	www.github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08

21 Nov 2024 07:50Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5 - 8.8

EPSS0.00189

SSVC

cve-2023-26130 package yhirose/cpp-httplib crlf injection http security vulnerability cve-2020-11709