CVE-2020-11709

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-11709

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11709.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2020-11709

Downstream

UBUNTU-CVE-2020-11709

Published

2020-04-12T14:15:10.750Z

Modified

2026-04-11T22:57:26.398577Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

cpp-httplib through 0.5.8 does not filter \r\n in parameters passed into the setredirect and setheader functions, which creates possibilities for CRLF injection and HTTP response splitting in some specific contexts.

References

Affected packages

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type

GIT

Repo

https://github.com/yhirose/cpp-httplib

Events

Introduced

Last affected

402d47e2cd819e420fd28af074d8de0fb2d19a0f

Database specific

{
    "cpe": "cpe:2.3:a:yhirose:cpp-httplib:*:*:*:*:*:*:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.5.8"
        }
    ]
}

Affected versions

v0.*

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11709.json"