Log in Start free

Vulnerability · Published May 30, 2023 · Assigned by snyk

CVE-2023-26130

High 7.5

In plain English

A high-severity command injection in yhirose/cpp-httplib. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 33.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12cpp-httplib0.11.4+ds-1+deb12u1DEBIAN-CVE-2023-26130
Debian:13cpp-httplib0.11.4+ds-2DEBIAN-CVE-2023-26130
Debian:14cpp-httplib0.11.4+ds-2DEBIAN-CVE-2023-26130

Affected products (as reported)

VendorProductVersions
n/a yhirose/cpp-httplib 0 – before 0.12.4

Weakness: CWE-93, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References