Arbitrary Code Injection Affecting cpp-httplib package, versions *


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.53% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2210-CPPHTTPLIB-5661628
  • published31 May 2023
  • disclosed30 May 2023

Introduced: 30 May 2023

CVE-2023-26130  (opens in a new tab)
CWE-74  (opens in a new tab)

How to fix?

There is no fixed version for Ubuntu:22.10 cpp-httplib.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cpp-httplib package and not the cpp-httplib package as distributed by Ubuntu. See How to fix? for Ubuntu:22.10 relevant fixed versions and status.

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors.

Note: This issue is present due to an incomplete fix for CVE-2020-11709.

CVSS Base Scores

version 3.1