CVE-2026-45372: cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

Synopsis

A CRLF injection flaw in cpp-httplib (yhirose's C++11 header-only HTTP library) lets an unauthenticated network attacker smuggle line terminators into stored header values. The server runs its header validity check before percent-decoding, so encoded %0D%0A sequences slip past validation and then expand to literal \r\n inside header storage, enabling HTTP response splitting, header injection, and downstream request smuggling against any consumer of those headers. A patched-image rebuild at cpp-httplib 0.44.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the cpp-httplib server over the network; any exposed HTTP endpoint built on the library is in scope.

• AuthenticationNot required

  No credentials are needed; the injection happens during header parsing before any application-level auth runs.

• Victim interactionNot required

  The server processes the malicious request on its own; no user click or session is involved.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring only a crafted header with percent-encoded CRLF bytes.

Blast Radius

• Injects arbitrary headers and body content into HTTP responses, enabling response splitting and cache poisoning against downstream proxies and clients.
• Tampers with header values that the application or upstream services trust for routing, authentication, or logging decisions.
• Smuggles secondary requests through intermediaries that re-serialize the parsed headers, leading to request smuggling on shared infrastructure.
• Can disrupt the affected service by corrupting protocol state on persistent connections.