CVE-2023-26130

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. **Note:** This issue is present due to an incomplete fix for [CVE-2020-11709](https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-2366507).

• CWE-93
• CWE-74
• CWE-77

• https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280Third Party Advisory
• https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08Patch
• https://github.com/yhirose/cpp-httplib/releases/tag/v0.12.4Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL/
• https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194Third Party Advisory
• https://gist.github.com/dellalibera/094aece17a86069a7d27f93c8aba2280Third Party Advisory
• https://github.com/yhirose/cpp-httplib/commit/5b397d455d25a391ba346863830c1949627b4d08Patch
• https://github.com/yhirose/cpp-httplib/releases/tag/v0.12.4Release Notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2RY6PKBU73I45L6YWNYCUK2XBEXEFX7L/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JY2E7EIRWQMKH6GY4OZOWWBZBY3Q7CGS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYODHZECXYFC2BNODZPZXZAXOKGMCYAP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6MO4FSKYNSAJVUXYP7LRY7ARUIGKBFL/
• https://security.snyk.io/vuln/SNYK-UNMANAGED-YHIROSECPPHTTPLIB-5591194Third Party Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26123Versions of the package raysan5/raylib before 4.5.0 are vuln…6.1
• CVE-2023-26125Versions of the package github.com/gin-gonic/gin before 1.9.…7.3
• CVE-2023-26126All versions of the package m.static are vulnerable to Direc…5.3
• CVE-2023-26127All versions of the package n158 are vulnerable to Command I…7.8
• CVE-2023-26128All versions of the package keep-module-latest are vulnerabl…7.8
• CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command…7.8
• CVE-2023-26131All versions of the package github.com/xyproto/algernon/engi…6.1
• CVE-2023-26132Versions of the package dottie before 2.0.4 are vulnerable t…7.5
• CVE-2023-26133All versions of the package progressbar.js are vulnerable to…9.8
• CVE-2023-26134Versions of the package git-commit-info before 2.0.2 are vul…9.8
• CVE-2023-26135All versions of the package flatnest are vulnerable to Proto…9.8
• CVE-2023-26136Versions of the package tough-cookie before 4.1.3 are vulner…9.8