CVE-2025-0825

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead to HTTP Response Splitting, XSS, and more.

References

Affected packages

Debian:12 / cpp-httplib

Package

Name: cpp-httplib
Purl: pkg:deb/debian/cpp-httplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.11.4+ds-1

0.11.4+ds-1+deb12u1

0.11.4+ds-2

0.11.4+ds-3

0.13.1+ds-1

0.14.0+ds-1

0.14.1+ds-1

0.14.1+ds-2

0.14.2+ds-1

0.14.3+ds-1

0.14.3+ds-1.1~exp1

0.14.3+ds-1.1

0.15.3+ds-1

0.15.3+ds-2

0.15.3+ds-3

0.16.0+ds-1

0.16.3+ds-1

0.16.3+ds-2

0.18.0+ds-1

0.18.7-1

0.20.1+ds-3

0.25.0+ds-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / cpp-httplib

Package

Name: cpp-httplib
Purl: pkg:deb/debian/cpp-httplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.18.7-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / cpp-httplib

Package

Name: cpp-httplib
Purl: pkg:deb/debian/cpp-httplib?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.18.7-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/yhirose/cpp-httplib

Affected ranges

Type: GIT
Repo: https://github.com/yhirose/cpp-httplib
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

9c36aae4b73e2b6e493f4133e4173103c9266289

Type: GIT
Repo: https://github.com/yhirose/cpp-httplib.git
Events: Introduced

61c418048d8b0e42cc55e908c1c2da1e2f617f86

Fixed

54f8a4d0f34acb3cc508e337d9881296b70201ad

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.13.0

v0.13.1

v0.13.2

v0.13.3

v0.14.0

v0.14.1

v0.14.2

v0.14.3

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.7.0

v0.7.1

v0.7.10

v0.7.11

v0.7.12

v0.7.13

v0.7.14

v0.7.15

v0.7.16

v0.7.17

v0.7.18

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.10

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

{
    "vanir_signatures": [
        {
            "digest": {
                "function_hash": "277590819831059525472533281089288552273",
                "length": 198.0
            },
            "source": "https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289",
            "id": "CVE-2025-0825-2d71384a",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "Request::set_header",
                "file": "httplib.h"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "line_hashes": [
                    "260809132634571723839772955850142221824",
                    "319534684125098744198272177949270052092",
                    "96823469935756260405829661134819320602"
                ],
                "threshold": 0.9
            },
            "source": "https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289",
            "id": "CVE-2025-0825-9cbcc937",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "test/test.cc"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "function_hash": "282002448680622989766430596597376481670",
                "length": 199.0
            },
            "source": "https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289",
            "id": "CVE-2025-0825-b1762a9f",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "Response::set_header",
                "file": "httplib.h"
            },
            "signature_type": "Function"
        },
        {
            "digest": {
                "line_hashes": [
                    "122865845419926169633108976348119279437",
                    "98933187978073131876729465628352425928",
                    "135424939433162493096086386300940917929",
                    "238031900777529823881172876332142156481",
                    "13103752831172150952358981631739970420",
                    "294716977488620022515304112326686077489",
                    "276027594476214969815632879869087700889",
                    "235224613071864695515402239674036034424",
                    "65652300073549646086793421028308367337",
                    "294716977488620022515304112326686077489",
                    "276027594476214969815632879869087700889",
                    "279196033155740987593201962810448484335",
                    "315534572009822831089630188210732145852",
                    "310443426124241150645112224040646570913",
                    "294204733884467423012074930542100496786",
                    "298508178807259458117828438646272216561"
                ],
                "threshold": 0.9
            },
            "source": "https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289",
            "id": "CVE-2025-0825-c968b88a",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "file": "httplib.h"
            },
            "signature_type": "Line"
        },
        {
            "digest": {
                "function_hash": "4183272750077159462135840059502598777",
                "length": 271.0
            },
            "source": "https://github.com/yhirose/cpp-httplib/commit/9c36aae4b73e2b6e493f4133e4173103c9266289",
            "id": "CVE-2025-0825-d0c62d47",
            "deprecated": false,
            "signature_version": "v1",
            "target": {
                "function": "Response::set_redirect",
                "file": "httplib.h"
            },
            "signature_type": "Function"
        }
    ]
}