PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45372 yhirose CVE debrief

A critical vulnerability exists in cpp-httplib prior to version 0.44.0, where percent-encoded CRLF sequences (%0D%0A) in HTTP header values bypass validity checks and are decoded to literal carriage return and line feed bytes. The is_field_value check runs before percent-decoding, allowing attackers to inject header value terminators into stored header values. This affects all header values except Location and Referer, which are handled separately. The vulnerability enables HTTP response splitting and request smuggling attacks by manipulating header parsing boundaries.

Vendor
yhirose
Product
cpp-httplib
CVSS
CRITICAL 9.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running HTTP servers built with cpp-httplib versions before 0.44.0, particularly those exposed to untrusted client requests or positioned behind reverse proxies where request smuggling could compromise security boundaries.

Technical summary

The cpp-httplib library's server-side request parsing applies percent-decoding to header values after running the is_field_value validity check. This timing discrepancy allows %0D%0A sequences to pass validation as benign encoded characters, then expand to literal CRLF bytes in the stored header value. The exception for Location and Referer headers indicates awareness of header-specific handling without extending protection to other headers. The vulnerability enables HTTP response splitting attacks where attackers inject header terminators to manipulate downstream parsing, and contributes to HTTP request smuggling when combined with desynchronized parsing between front-end and back-end systems. The fix in 0.44.0 restructures validation to account for percent-decoded values.

Defensive priority

critical

Recommended defensive actions

  • Upgrade cpp-httplib to version 0.44.0 or later
  • Audit applications using cpp-httplib for header injection vulnerabilities in request handling
  • Implement WAF rules to detect and block percent-encoded CRLF sequences (%0D%0A) in HTTP headers
  • Review proxy and load balancer configurations for HTTP request smuggling protections
  • Monitor for anomalous HTTP traffic patterns indicating header manipulation attempts

Evidence notes

CVE published 2026-05-29T20:16:26.473Z; modified 2026-05-29T20:23:08.683Z. Advisory confirms fix in 0.44.0. CVSS 9.9 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. CWE-93 (Improper Neutralization of CRLF Sequences) and CWE-444 (HTTP Request/Response Smuggling) identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45372 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45372

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45372 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45372

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.