CVE-2025-0825

MEDIUM

cpp-httplib 0.17.3-0.18.3 - HTTP Response Splitting via Null Byte Prefixed CRLF Injection

Title source: llm
STIX 2.1

Description

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0038
EPSS Percentile 29.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-113
Status published
Products (1)
yhirose/cpp-httplib 0.17.3 - 0.18.4
Published Feb 04, 2025
Tracked Since Feb 18, 2026