Homepage

HTTP Response Splitting Affecting cpp-httplib package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.37% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-CPPHTTPLIB-21176387
  • published18 Oct 2026
  • disclosed14 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 14 Oct 2026

NewCVE-2026-103930  (opens in a new tab)
CWE-113  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable cpp-httplib.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpp-httplib package and not the cpp-httplib package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::open_stream in httplib.h accepts a caller-controlled path that reaches detail::write_request_line() without the detail::encode_path() protection used by the ordinary buffered request path. Raw carriage-return and line-feed bytes in the path can therefore split the outbound HTTP/1.1 request line and inject attacker-shaped request metadata. Exploitation requires an embedding application to pass remote user input into the open_stream path and a backend or intermediary that interprets the injected bytes; the established impact is modification of backend-visible request data, not direct confidentiality or availability impact. This issue is fixed in version 0.51.0.