CVE-2026-45372

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's server parses an incoming request, it applies percent-decoding to every header value except Location and Referer. The validity check (is_field_value) is run before decoding, so encoded %0D%0A passes the check and is then expanded to a literal \r\n byte pair inside the stored header value. This vulnerability is fixed in 0.44.0.

• CWE-93
• CWE-444

• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4mExploit, Mitigation, Vendor Advisory
• https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjxg-64p4-vj4mExploit, Mitigation, Vendor Advisory

Published

May 29, 2026

Last Modified

Jul 22, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45367HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-45368Kirby is an open-source content management system. In versio…8.4
• CVE-2026-45369python-utcp is the python implementation of UTCP. Prior to 1…8.3
• CVE-2026-4537A vulnerability was determined in Cudy TR1200 R46-2.4.15-202…4.7
• CVE-2026-45370python-utcp is the python implementation of UTCP. Prior to 1…7.7
• CVE-2026-45371SiYuan is an open-source personal knowledge management syste…7.2
• CVE-2026-45373CodeWhale is a DeepSeek + MiMo coding agent in terminal. Pri…7.4
• CVE-2026-45374CodeWhale is a DeepSeek + MiMo coding agent in terminal. Pri…9.6
• CVE-2026-45375SiYuan is an open-source personal knowledge management syste…9
• CVE-2026-45376Decidim is a participatory democracy framework. Prior to 0.3…5.5
• CVE-2026-45377Decidim is a participatory democracy framework. Prior to 0.3…6.5
• CVE-2026-45378Decidim is a participatory democracy framework. Prior to 0.3…7.5